CVE-2026-48596 CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection

[
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.Tesla.Multipart'"
    ],
    "packageName": "tesla",
    "packageURL": "pkg:hex/tesla",
    "product": "tesla",
    "programFiles": [
      "lib/tesla/multipart.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
      },
      {
        "name": "'Elixir.Tesla.Multipart':headers/1"
      }
    ],
    "repo": "https://github.com/elixir-tesla/tesla",
    "vendor": "elixir-tesla",
    "versions": [
      {
        "lessThan": "1.18.3",
        "status": "affected",
        "version": "0.8.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.Tesla.Multipart'"
    ],
    "packageName": "elixir-tesla/tesla",
    "packageURL": "pkg:github/elixir-tesla/tesla",
    "product": "tesla",
    "programFiles": [
      "lib/tesla/multipart.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
      },
      {
        "name": "'Elixir.Tesla.Multipart':headers/1"
      }
    ],
    "repo": "https://github.com/elixir-tesla/tesla.git",
    "vendor": "elixir-tesla",
    "versions": [
      {
        "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
        "status": "affected",
        "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
        "versionType": "git"
      }
    ]
  }
]