The vulnerability arises when Tesla constructs multipart disposition headers without escaping CR (\r), LF (\n), or double‑quote characters; an attacker can inject line breaks or quotes into the header, resulting in forged headers such as an alternate Content‑Type or premature termination of the header block. This change in header values can affect how the receiving server interprets the part, potentially leading to unintended behavior when the request is forwarded.

The issue affects the Elixir‑Tesla library "Tesla" from version 0.8.0 up to, but not including, 1.18.3. Any application that uses the library’s Multipart functions—add_field/4, add_file/3, add_file_content/4—to build HTTP requests with user‑supplied names, filenames or disposition options is vulnerable.

The CVSS score of 2.1 indicates low severity, and the EPSS is not reported. The vulnerability is not listed in CISA KEV. Exploitation would require the attacker to craft a multipart request that the application forwards via Tesla, which is a relatively narrow attack surface. The likely vector is during inbound requests that are processed by the application and sent downstream using Tesla, making this risk low to medium in typical deployments.