Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata. Req.Utils.encode_form_part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-supplied name, filename, and content_type values directly into the content-disposition and content-type lines with no escaping or CRLF stripping. A value containing ", \r, or \n closes the surrounding quoted value and starts a new header line; an additional \r\n--<boundary> terminates the current part and prepends a smuggled part of the attacker's choosing. This is reachable through every supported way of supplying a part. It is particularly easy when value is a %File.Stream{}, because filename then defaults to Path.basename(stream.path) and POSIX filenames may legitimately contain \r and \n. Any application that forwards user-controlled filenames (or field names / MIME types) through Req.post/2 with form_multipart: lets an attacker inject arbitrary headers into the outgoing multipart body or smuggle additional fields and parts into the request the victim service sends downstream. This issue affects req: from 0.5.3 before 0.6.0.

• https://cna.erlef.org/cves/CVE-2026-49756.html
• https://github.com/wojtekmach/req/commit/74506ff2c5addf74df85d79dc726e9b2e264a8ba
• https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m
• https://osv.dev/vulnerability/EEF-CVE-2026-49756
• https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m

• Wojtekmach » Req » Version: 0.5.10
  cpe:2.3:a:wojtekmach:req:0.5.10
• Wojtekmach » Req » Version: 0.5.11
  cpe:2.3:a:wojtekmach:req:0.5.11
• Wojtekmach » Req » Version: 0.5.12
  cpe:2.3:a:wojtekmach:req:0.5.12
• Wojtekmach » Req » Version: 0.5.13
  cpe:2.3:a:wojtekmach:req:0.5.13
• Wojtekmach » Req » Version: 0.5.14
  cpe:2.3:a:wojtekmach:req:0.5.14
• Wojtekmach » Req » Version: 0.5.15
  cpe:2.3:a:wojtekmach:req:0.5.15
• Wojtekmach » Req » Version: 0.5.16
  cpe:2.3:a:wojtekmach:req:0.5.16
• Wojtekmach » Req » Version: 0.5.17
  cpe:2.3:a:wojtekmach:req:0.5.17
• Wojtekmach » Req » Version: 0.5.18
  cpe:2.3:a:wojtekmach:req:0.5.18
• Wojtekmach » Req » Version: 0.5.3
  cpe:2.3:a:wojtekmach:req:0.5.3
• Wojtekmach » Req » Version: 0.5.4
  cpe:2.3:a:wojtekmach:req:0.5.4
• Wojtekmach » Req » Version: 0.5.5
  cpe:2.3:a:wojtekmach:req:0.5.5
• Wojtekmach » Req » Version: 0.5.6
  cpe:2.3:a:wojtekmach:req:0.5.6
• Wojtekmach » Req » Version: 0.5.7
  cpe:2.3:a:wojtekmach:req:0.5.7
• Wojtekmach » Req » Version: 0.5.8
  cpe:2.3:a:wojtekmach:req:0.5.8
• Wojtekmach » Req » Version: 0.5.9
  cpe:2.3:a:wojtekmach:req:0.5.9