High 8.2Published Jun 2, 2026

CVE-2026-48594Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression

Updated under an hour ago (Oct 28, 2026, 5:50 AM ET)

Does this affect you?

It affects elixir-tesla tesla. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for elixir-tesla tesla

Exploited in the last 30 days

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-tesla tesla allows a denial of service via decompression bomb in HTTP response bodies. When Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression is included in a Tesla middleware pipeline, HTTP response bodies are decompressed eagerly with no size limit. The decompress_body/2 function in lib/tesla/middleware/compression.ex passes the entire response body to :zlib.gunzip/1 or :zlib.unzip/1 without any cap on the output size. Additionally, compression_algorithms/1 splits the content-encoding header on commas and decompress_body/2 recurses once per token, applying a decompression pass on each iteration. A server advertising content-encoding: gzip, gzip, gzip, gzip causes four recursive decompression passes, yielding exponential amplification: each gzip layer can expand its input roughly 1000x, so a payload of a few hundred bytes on the wire inflates to gigabytes of BEAM heap, exhausting memory and crashing or freezing the calling process. This issue affects tesla: from 0.6.0 before 1.18.3.

CVSS: 8.2 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-409
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: EEF
NVD analysis: Modified
Record last updated: Sep 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

elixir-tesla tesla elixir-tesla:tesla	from 0.6.0 before 1.18.3	CNA record
elixir-tesla tesla elixir-tesla:tesla	from 0.6.0 before 1.18.3	NVD

References

References

https://github.com/elixir-tesla/tesla/security/advisories/GHSA-mc85-72gr-vm9f	vendor-advisory, related, exploit
https://cna.erlef.org/cves/CVE-2026-48594.html	related, third-party-advisory
https://osv.dev/vulnerability/EEF-CVE-2026-48594	related, third-party-advisory
https://github.com/elixir-tesla/tesla/commit/5bd90bb5cf0d15e375edc2a66fa322292940fce2	related
https://github.com/elixir-tesla/tesla/commit/340f75b5d191dc747ef7ac6365bd002d1cd55a9d	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.