Skip to content
Threat Feed
Subscribe

Vendor

Elixir-Tesla

2 briefs RSS
medium advisory

Tesla Elixir Client Decompression Bomb (CVE-2026-48594)

A critical vulnerability, CVE-2026-48594, in the Tesla Elixir HTTP client library allows an attacker to cause a denial of service by serving a specially crafted HTTP response with multiple `content-encoding` headers that, when processed by vulnerable versions (0.6.0 through 1.18.2) of the client using `Tesla.Middleware.DecompressResponse` or `Tesla.Middleware.Compression`, leads to exponential memory expansion and application crashes.

tesla resource-exhaustion denial-of-service library-vulnerability elixir
1t 1c
medium advisory

Tesla HTTP Client Library Vulnerable to Atom Exhaustion Leading to Denial of Service (CVE-2026-48597)

A high-severity denial-of-service vulnerability (CVE-2026-48597) in the `Tesla.Adapter.Mint` component of the Elixir Tesla HTTP client library, affecting versions 1.3.0 through 1.18.2, allows an unauthenticated attacker to crash the underlying BEAM VM by supplying untrusted URL schemes, leading to atom exhaustion.

tesla denial-of-service elixir erlang vulnerability web-application
1t 1c