CVE-2026-49756— Multipart form-data header injection in Req via unescaped name/filename/content_type

Multipart form-data header injection in Req via unescaped name/filename/content_type

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata. Req.Utils.encode_form_part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-supplied name, filename, and content_type values directly into the content-disposition and content-type lines with no escaping or CRLF stripping. A value containing ", \r, or \n closes the surrounding quoted value and starts a new header line; an additional \r\n--<boundary> terminates the current part and prepends a smuggled part of the attacker's choosing. This is reachable through every supported way of supplying a part. It is particularly easy when value is a %File.Stream{}, because filename then defaults to Path.basename(stream.path) and POSIX filenames may legitimately contain \r and \n. Any application that forwards user-controlled filenames (or field names / MIME types) through Req.post/2 with form_multipart: lets an attacker inject arbitrary headers into the outgoing multipart body or smuggle additional fields and parts into the request the victim service sends downstream. This issue affects req: from 0.5.3 before 0.6.0.

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

对CRLF序列的转义处理不恰当(CRLF注入)

req 注入漏洞

req是roc个人开发者的一个使用 Black Magic 的简单 Go HTTP 客户端。 Req 0.5.3版本至0.6.0之前版本存在注入漏洞，该漏洞源于CRLF序列中和不当，可能导致通过攻击者影响的部分元数据进行多部分参数走私。

N/A

N/A