Tesla (>= 0.6.0, < 1.18.3) - CraftedSignal Threat Feed

Tesla Elixir Client Decompression Bomb (CVE-2026-48594)

hello@craftedsignal.io — Fri, 10 Jul 2026 00:08:28 +0000

A high-severity vulnerability, tracked as CVE-2026-48594, exists in the Tesla Elixir HTTP client library, specifically affecting versions 0.6.0 through 1.18.2. This flaw, dubbed a "decompression bomb," can be exploited by an attacker who controls a server that a vulnerable Tesla client contacts, or via a redirect. The vulnerability arises when the Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression middleware component eagerly decompresses HTTP response bodies without any size limits. An attacker can craft a minuscule gzip-encoded payload coupled with multiple content-encoding headers (e.g., gzip, gzip, gzip, gzip), which, upon recursive decompression, expands exponentially into gigabytes of data on the BEAM heap. This excessive memory consumption inevitably leads to the client application crashing or freezing, effectively causing a denial of service. Defenders must ensure that applications utilizing the affected tesla library are patched to version 1.18.3 or later to mitigate this risk.

Attack Chain

An attacker gains control of a server or compromises a legitimate server that a victim's Tesla client application is likely to contact.
The attacker configures the server to serve a specially crafted HTTP response.
The crafted response includes a tiny gzip-compressed payload that is designed to expand significantly upon decompression.
Crucially, the response features multiple content-encoding headers, such as gzip, gzip, gzip, gzip, to trigger recursive decompression.
A legitimate application, running an affected tesla library version (0.6.0 to 1.18.2) and configured with Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression, makes an HTTP request to the attacker-controlled server.
The tesla client receives the malicious HTTP response from the attacker's server.
The decompress_body/2 function within the tesla middleware attempts to decompress the response recursively for each content-encoding token, without any output size validation.
This process exponentially inflates the small payload into gigabytes of data within the BEAM heap, exhausting the application's memory resources and causing it to crash or freeze, resulting in a denial of service.

Impact

The impact of CVE-2026-48594 is a denial of service (DoS) for any application utilizing the affected tesla client library (versions 0.6.0 through 1.18.2) with the Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression middleware. The attacker's objective is to render the targeted application unusable by forcing it to consume all available memory. A successful attack can lead to application downtime, data processing failures, and disruption of critical services, potentially affecting any sector relying on Elixir applications performing HTTP requests with the vulnerable middleware. This vulnerability carries a high severity CVSS v4.0 score of 8.2.

Recommendation

Patch CVE-2026-48594 by upgrading the erlang/tesla package to version 1.18.3 or later immediately.
Review applications for the inclusion of Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression in their Tesla middleware pipeline. If present, ensure they are running patched versions.
Implement application-level monitoring for abnormal and sudden increases in memory consumption by Elixir applications, especially those making outbound HTTP requests, to detect potential exploitation attempts.

Tesla Elixir HTTP Client Header Leak via Case-Sensitive Redirect Filtering (CVE-2026-48595)

hello@craftedsignal.io — Fri, 10 Jul 2026 00:07:45 +0000

A high-severity vulnerability, CVE-2026-48595, has been identified in the tesla Elixir HTTP client library, specifically within its Tesla.Middleware.FollowRedirects component. This flaw impacts versions 0.6.0 up to, but not including, 1.18.3. The middleware is designed to strip sensitive Authorization headers when following cross-origin redirects to prevent credential leakage. However, its internal filter performs a case-sensitive comparison against a lowercase string "authorization". Because tesla preserves header keys exactly as supplied, applications using the RFC 7235 canonical casing ("Authorization") bypass this filter entirely. Consequently, if an application sends a request with an Authorization header using canonical casing and is redirected to an attacker-controlled origin, sensitive credentials like bearer tokens can be inadvertently leaked to the attacker. This poses a significant risk to applications relying on tesla for secure HTTP communications.

Attack Chain

An attacker establishes control over a web server or service capable of issuing HTTP 302 redirects to an arbitrary, attacker-controlled domain (e.g., a malicious server, a redirect-open service, or a compromised upstream server).
A victim application, using the tesla Elixir HTTP client library (version 0.6.0 through 1.18.2) with Tesla.Middleware.FollowRedirects enabled, constructs an outbound HTTP request.
The victim application includes an Authorization header with canonical casing (e.g., {"Authorization", "Bearer "}) for authentication in its request.
The victim application sends its request to an endpoint, which the attacker can influence to issue an HTTP 302 (or similar redirect status code) pointing to the attacker-controlled domain.
The Tesla.Middleware.FollowRedirects component within the victim application attempts to filter sensitive headers before automatically following the redirect.
Due to a case-sensitive comparison logic ("authorization" vs. "Authorization"), the middleware fails to identify and strip the canonical Authorization header from the outgoing request.
The tesla client follows the redirect and inadvertently includes the sensitive Authorization header, complete with its bearer token or other credentials, in the request to the attacker-controlled domain, leading to credential theft.

Impact

The vulnerability carries a high severity (CVSS v4.0: 8.2). Any application utilizing tesla versions 0.6.0 through 1.18.2 with Tesla.Middleware.FollowRedirects and supplying non-lowercase Authorization headers is at risk. Successful exploitation results in the leakage of sensitive credentials, such as bearer tokens, to an attacker-controlled endpoint. This can lead to unauthorized access to systems or data, session hijacking, and further compromise of the victim's environment, directly impacting the confidentiality and integrity of affected applications and their users.

Recommendation

Prioritize upgrading the tesla Elixir HTTP client library to version 1.18.3 or later immediately to remediate CVE-2026-48595.
If immediate patching is not possible, implement the recommended workaround by normalizing all Authorization header keys to lowercase (e.g., "authorization") before passing them to tesla via Tesla.put_header/3 or Tesla.Middleware.Headers.
Review application code for the usage of Tesla.Middleware.FollowRedirects and how Authorization headers are set to identify potentially vulnerable instances.