The vulnerability arises because Tesla.Multipart.add_content_type_param/2 does not sanitize input parameters for CR (\r) or LF (\n) characters before appending them to the content_type_params list. Subsequently, Tesla.Multipart.headers/1 constructs the Content-Type header by joining these parameters with "; ", allowing an attacker to inject arbitrary HTTP headers by including CRLF sequences in the input. This can lead to HTTP request/response splitting attacks in applications using affected versions of the tesla library (0.8.0 up to but not including 1.18.3) when untrusted input is passed to add_content_type_param/2.

The impact is limited to HTTP header injection via request/response splitting, which can potentially allow attackers to manipulate HTTP headers in outbound requests. The CVSS 4.0 base score is 2.1, indicating low severity with local attack vector and low impact on confidentiality, integrity, and availability. There are no known exploits in the wild. The vulnerability requires the attacker to supply crafted input to the vulnerable function, which is typically a local or application-level vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing untrusted or user-supplied input directly to Tesla.Multipart.add_content_type_param/2. Implement input validation or sanitization to remove CR and LF characters from parameters before passing them to this function.