This vulnerability arises from the lack of escaping or CRLF stripping for the name, filename, and content_type parameters used in multipart form-data headers. The flaw allows an attacker to include carriage return, line feed, or quote characters, breaking out of the intended header fields and injecting arbitrary HTTP headers or smuggling additional multipart parts. This can enable unauthorized modification of the downstream request sent by the application, potentially leading to subtle or severe functional changes.

The issue affects the Req HTTP client library developed by wojtekmach, specifically versions starting at 0.5.3 up to, but not including, 0.6.0. Applications built with these versions that use Req.post/2 with form_multipart and supply user-controlled field names, filenames or MIME types are vulnerable. The vulnerability is present in any code path that builds multipart bodies through Req.Utils.encode_form_part/2.

The CVSS score of 2.1 reflects a low severity impact. Because the flaw is limited to header manipulation, it does not provide direct code execution. Exploitation requires that the target application forwards user-controlled multipart parameters through Req to another service; the attack remains in the network path, not on the target host. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be through client applications that allow file uploads or long field names, using Po­siX filenames that could contain CRLF. By injecting malicious header values the attacker can alter or inject additional parts into the request delivered downstream.