CVE-2026-48594

Name of the Vulnerable Software and Affected Versions tesla versions 0.6.0 through 1.18.2

Description An improper handling of highly compressed data allows a denial of service via a decompression bomb in HTTP response bodies. When Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression is used in a middleware pipeline, response bodies are decompressed eagerly without a size limit. The decompress body/2 function passes the entire response body to :zlib.gunzip/1 or :zlib.unzip/1 without capping the output size. Furthermore, the compression algorithms/1 function splits the content-encoding header by commas, and decompress body/2 recurses for each token. A server providing a content-encoding header with multiple gzip tokens can trigger recursive decompression passes, causing exponential data amplification where a small network payload expands into gigabytes of BEAM heap (the memory area used by the Erlang virtual machine), leading to memory exhaustion and crashing or freezing the calling process.

Recommendations Update tesla to version 1.18.3. As a temporary workaround, avoid including Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression in the Tesla middleware pipeline.