CVE-2026-49756: Req CRLF Injection Vulnerability

CVE-2026-49756 Overview

CVE-2026-49756 is a CRLF (Carriage Return Line Feed) injection vulnerability in the wojtekmach/req HTTP client library for Elixir. The flaw resides in Req.Utils.encode_form_part/2 within lib/req/utils.ex, which interpolates caller-supplied name, filename, and content_type values into multipart headers without escaping or stripping CRLF sequences. Attackers who control any of these values can inject arbitrary headers, terminate the current multipart segment, and smuggle additional parts into the outgoing request. The issue affects req versions from 0.5.3 before 0.6.0 and is classified under CWE-93: Improper Neutralization of CRLF Sequences.

Critical Impact
Applications forwarding user-controlled filenames, field names, or MIME types through Req.post/2 with form_multipart: can have arbitrary headers and smuggled fields injected into downstream multipart requests.

Affected Products

wojtekmach Req versions 0.5.3 through 0.5.x
Elixir applications using Req.post/2 with the form_multipart: option
Applications passing %File.Stream{} values where the filename derives from Path.basename(stream.path)

Discovery Timeline

2026-06-08 - CVE-2026-49756 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-49756

Vulnerability Analysis

The vulnerability stems from unsanitized string interpolation when building per-part HTTP headers. Req.Utils.encode_form_part/2 constructs the content-disposition and content-type header lines by directly inserting the caller-supplied name, filename, and content_type values into the quoted-string positions. The function performs no escaping of quote characters and no stripping of \r or \n byte sequences.

An attacker who supplies a value containing ", \r, or \n can close the surrounding quoted attribute and inject a new header line. Adding an additional \r\n--<boundary> sequence terminates the current part and prepends a smuggled multipart segment of the attacker's choosing into the outgoing body.

The weakness maps to CWE-93, Improper Neutralization of CRLF Sequences. The attack vector is local because exploitation requires the vulnerable application to relay attacker-influenced metadata into an outbound HTTP request.

Root Cause

The root cause is the absence of input neutralization in Req.Utils.encode_form_part/2 in lib/req/utils.ex. Caller-supplied part metadata is concatenated into HTTP header lines without validation against the grammar defined by RFC 7578 for multipart form data. Refer to the GitHub Security Advisory GHSA-px9f-whj3-246m for the maintainer's analysis.

Attack Vector

Exploitation is reachable through every supported path for supplying a multipart part. The condition is particularly easy to trigger when the value is a %File.Stream{}, because filename then defaults to Path.basename(stream.path) and POSIX filenames may legitimately contain \r and \n bytes. Any application that forwards user-controlled filenames, field names, or MIME types through Req.post/2 with form_multipart: becomes an injection sink. Review the upstream commit 74506ff2c5 for the corrective code path.

No verified public exploit code is available. The vulnerability mechanism is documented in the CNA advisory for CVE-2026-49756 and the OSV entry EEF-CVE-2026-49756.

Detection Methods for CVE-2026-49756

Indicators of Compromise

Outbound multipart HTTP requests containing unexpected Content-Disposition headers or duplicate part boundaries within a single body.
Filenames, form field names, or MIME types in application logs containing literal \r, \n, or unescaped " characters.
Downstream services receiving form fields that were not declared by the originating application.

Detection Strategies

Inventory Elixir projects using the req dependency and identify versions in the affected range >= 0.5.3, < 0.6.0 via mix.lock.
Static analysis of source code for invocations of Req.post/2 and related helpers that pass form_multipart: with user-influenced name, filename, or content_type parameters.
Network monitoring on egress proxies for malformed multipart bodies, including embedded CRLF sequences inside quoted header attributes.

Monitoring Recommendations

Capture and inspect outbound HTTP request bodies from applications using req for anomalous multipart structures.
Alert on file upload endpoints where user-supplied filenames contain control characters before they reach HTTP client libraries.
Track dependency versions in CI pipelines and flag builds that resolve req to versions below 0.6.0.

How to Mitigate CVE-2026-49756

Immediate Actions Required

Upgrade req to version 0.6.0 or later in all Elixir applications.
Audit application code for any path that forwards user-controlled name, filename, or content_type values into Req.post/2 with form_multipart:.
Sanitize filenames derived from %File.Stream{} paths by stripping \r, \n, and " before invoking multipart upload helpers.

Patch Information

The fix is included in req version 0.6.0. The corrective change is published as GitHub commit 74506ff2c5 and tracked through GitHub Security Advisory GHSA-px9f-whj3-246m. Update the dependency in mix.exs and run mix deps.update req followed by mix deps.get.

Workarounds

Reject or normalize any user-supplied filename, field name, or MIME type containing CR, LF, or double-quote bytes before passing it to req.
Replace %File.Stream{} values that rely on default filename derivation with explicit, server-controlled filename values.
Constrain MIME types to a server-side allowlist rather than accepting client-supplied content types.

bash

# Update req in mix.exs to a patched version
# {:req, "~> 0.6.0"}
mix deps.update req
mix deps.get
mix deps.compile req