Req
Monthly
Memory exhaustion in wojtekmach Req (Elixir HTTP client) versions 0.1.0 through 0.6.0 allows attacker-controlled HTTP servers to crash the BEAM process via decompression-bomb response bodies. Because Req enabled automatic body decompression and archive decoding by default with no size caps, a sub-megabyte response advertising gzip/zip/tar content can expand to multiple gigabytes in memory. No public exploit identified at time of analysis, but the fix and root cause are documented in the upstream advisory GHSA-655f-mp8p-96gv.
CRLF injection in Req, the Elixir HTTP client library (versions 0.5.3 through before 0.6.0), allows an attacker who can influence multipart form field metadata - specifically name, filename, or content_type values - to inject arbitrary headers into outgoing multipart requests or smuggle additional form parts. The flaw exists because Req.Utils.encode_form_part/2 interpolates caller-supplied metadata directly into Content-Disposition and Content-Type header lines without escaping double-quotes, carriage returns, or newlines. The attack surface is particularly accessible when using File.Stream inputs, since POSIX filenames may legitimately contain CR/LF characters. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, any application forwarding user-controlled filenames through Req.post/2 with form_multipart is affected.
Memory exhaustion in wojtekmach Req (Elixir HTTP client) versions 0.1.0 through 0.6.0 allows attacker-controlled HTTP servers to crash the BEAM process via decompression-bomb response bodies. Because Req enabled automatic body decompression and archive decoding by default with no size caps, a sub-megabyte response advertising gzip/zip/tar content can expand to multiple gigabytes in memory. No public exploit identified at time of analysis, but the fix and root cause are documented in the upstream advisory GHSA-655f-mp8p-96gv.
CRLF injection in Req, the Elixir HTTP client library (versions 0.5.3 through before 0.6.0), allows an attacker who can influence multipart form field metadata - specifically name, filename, or content_type values - to inject arbitrary headers into outgoing multipart requests or smuggle additional form parts. The flaw exists because Req.Utils.encode_form_part/2 interpolates caller-supplied metadata directly into Content-Disposition and Content-Type header lines without escaping double-quotes, carriage returns, or newlines. The attack surface is particularly accessible when using File.Stream inputs, since POSIX filenames may legitimately contain CR/LF characters. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, any application forwarding user-controlled filenames through Req.post/2 with form_multipart is affected.