Executive Summary

CVE-2026-49756 is a vulnerability in the Req library versions 0.5.3 to before 0.6.0 that allows multipart parameter smuggling via CRLF (Carriage Return Line Feed) injection.

The issue occurs because the function encode_form_part/2 in Req.Utils directly interpolates user-supplied values for name, filename, and content_type into multipart form-data headers without escaping or stripping CRLF characters.

An attacker can include special characters like quotes, carriage returns, or newlines in these fields, which prematurely close the current header line and start new ones, allowing injection of arbitrary headers or additional parts into the multipart request.

This is especially exploitable when filenames come from user-controlled sources, such as file streams where the filename defaults to the basename of the file path, which may contain CR or LF characters.

As a result, an attacker can smuggle extra form fields or parts into requests sent downstream by applications using Req.post/2 with form_multipart enabled.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to inject arbitrary headers or smuggle additional parts into HTTP multipart form-data requests.

Such injection can lead to HTTP request smuggling or multipart parameter smuggling attacks, potentially causing the victim service to process malicious or unintended data.

Applications that forward user-controlled filenames, field names, or MIME types through Req.post/2 with form_multipart enabled are vulnerable.

The impact includes manipulation of downstream requests, which could lead to security issues such as unauthorized data injection or bypassing input validation.

However, the CVSS score is low (2.1), indicating that the exploit complexity is low but the overall impact is limited.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves multipart form-data header injection via unescaped name, filename, and content_type fields in HTTP requests. Detection can focus on inspecting outgoing multipart/form-data requests for suspicious or malformed headers that include CR (\r) or LF (\n) characters within these fields.

You can monitor HTTP traffic on your network or system using tools like tcpdump or Wireshark to capture multipart/form-data requests and look for injected CRLF sequences or unexpected headers.

Example commands to capture and inspect traffic:

• Use tcpdump to capture HTTP traffic on port 80 or 443 (if unencrypted): tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
• Use Wireshark to filter HTTP multipart/form-data requests and examine headers for CR or LF characters in name, filename, or content_type fields.

Additionally, review application logs or proxy logs for malformed multipart requests or unexpected header injections.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade the Req library to version 0.6.0 or later, where the issue has been fixed by properly escaping name, filename, and content_type parameters in multipart form-data headers.

If upgrading is not immediately possible, sanitize or normalize all user-controlled inputs that are used as name, filename, or content_type values in multipart requests by rejecting or stripping carriage return (\r), newline (\n), and double quote (") characters before passing them to Req.post/2.

Avoid using Path.basename/1 on user-controlled paths directly for filenames without normalization, as POSIX filenames may contain CR or LF characters.

Review and monitor your application for any suspicious multipart requests that could exploit this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0