PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49756 wojtekmach CVE debrief

CVE-2026-49756 is an Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in the Req library. This vulnerability allows multipart parameter smuggling via attacker-influenced part metadata. The issue arises from the `Req.Utils.encode_form_part/2` function in `lib/req/utils.ex`, which builds per-part headers by directly interpolating caller-supplied values (name, filename, and content_type) into content-disposition and content-type lines without proper escaping or CRLF stripping.

Vendor
wojtekmach
Product
req
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-08-18
Advisory published
2026-06-08
Advisory updated
2026-08-18

Who should care

The vulnerability affects applications using the Req library (versions from 0.5.3 before 0.6.0) that forward user-controlled filenames or field names through `Req.post/2` with `form_multipart`. This could allow an attacker to inject arbitrary headers into the outgoing multipart body or smuggle additional fields and parts into the request sent downstream by the victim service.

Technical summary

The `Req.Utils.encode_form_part/2` function is vulnerable to CRLF injection attacks. Specifically, if a value contains a double quote (”), carriage return (r), or newline (n), it can close the surrounding quoted value and start a new header line. An additional `r n -- <boundary>` can terminate the current part and prepend a smuggled part of the attacker's choice. This issue is particularly exploitable when the value is a `%File.Stream{}`, as the filename defaults to `Path.basename(stream.path)`, and POSIX filenames can legitimately contain `r` and `n`.

Defensive priority

The CVSS score for this vulnerability is 2.1, indicating a Low severity. However, the impact can be significant if the application is configured to forward user-controlled data through Req.

Recommended defensive actions

  • Upgrade to Req version 0.6.0 or later.
  • Avoid using user-controlled filenames or field names with `Req.post/2` and `form_multipart`.
  • Validate and sanitize user input to prevent CRLF injection.

Evidence notes

The CVE record was published on 2026-06-08T16:16:44.040Z and modified on 2026-06-09T15:20:13.097Z. The vulnerability was reported through multiple sources, including GitHub and the NVD.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49756 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49756

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49756 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49756

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://cna.erlef.org/cves/CVE-2026-49756.html

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/wojtekmach/req/commit/74506ff2c5addf74df85d79dc726e9b2e264a8ba

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://osv.dev/vulnerability/EEF-CVE-2026-49756

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.