CVE-2026-48594
published 2026-06-02CVE-2026-48594: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-tesla tesla allows a denial of service via decompression bomb in HTTP…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.70%
52.7th percentile
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-tesla tesla allows a denial of service via decompression bomb in HTTP response bodies.
When Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression is included in a Tesla middleware pipeline, HTTP response bodies are decompressed eagerly with no size limit. The decompress_body/2 function in lib/tesla/middleware/compression.ex passes the entire response body to :zlib.gunzip/1 or :zlib.unzip/1 without any cap on the output size. Additionally, compression_algorithms/1 splits the content-encoding header on commas and decompress_body/2 recurses once per token, applying a decompression pass on each iteration. A server advertising content-encoding: gzip, gzip, gzip, gzip causes four recursive decompression passes, yielding exponential amplification: each gzip layer can expand its input roughly 1000x, so a payload of a few hundred bytes on the wire inflates to gigabytes of BEAM heap, exhausting memory and crashing or freezing the calling process.
This issue affects tesla: from 0.6.0 before 1.18.3.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elixir-tesla | tesla | >= 0.6.0 < 1.18.3 | 1.18.3 |
| elixir-tesla | tesla | >= 5bd90bb5cf0d15e375edc2a66fa322292940fce2 < 340f75b5d191dc747ef7ac6365bd002d1cd55a9d | 340f75b5d191dc747ef7ac6365bd002d1cd55a9d |
| nvidia | tesla | >= 0.6.0 < 1.18.3 | 1.18.3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Tesla has decompression bomb on response body
ghsa·2026-07-10
CVE-2026-48594 [HIGH] CWE-409 Tesla has decompression bomb on response body
Tesla has decompression bomb on response body
### Summary
Any Tesla client pipeline that includes `Tesla.Middleware.DecompressResponse` or `Tesla.Middleware.Compression` eagerly decompresses HTTP response bodies with no size limit. A server under attacker control (or reached via a redirect) can return a tiny gzip-encoded payload that expands into gigabytes of BEAM heap, crashing or freezing the calling process. Stacking multiple `content-encoding` tokens multiplies the amplification exponentially.
### Details
`decompress_body/2` in `lib/tesla/middleware/compression.ex` passes the full response body to `:zlib.gunzip/1` or `:zlib.unzip/1` with no cap on output size. The list of codec tokens comes from splitting the `content-encoding` header on commas, and `decompress_body/2` recurses onc
VulDB
elixir-tesla up to 1.18.2 compression.ex decompress_body data amplification (GHSA-mc85-72gr-vm9f)
vuldb·2026-06-03·CVSS 8.2
CVE-2026-48594 [HIGH] elixir-tesla up to 1.18.2 compression.ex decompress_body data amplification (GHSA-mc85-72gr-vm9f)
A vulnerability was found in elixir-tesla tesla up to 1.18.2. It has been classified as problematic. Impacted is the function decompress_body in the library lib/tesla/middleware/compression.ex. This manipulation causes highly compressed data.
This vulnerability is registered as CVE-2026-48594. Remote exploitation of the attack is possible. No exploit is available.
Upgrading the affected component is recommended.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cna.erlef.org/cves/CVE-2026-48594.htmlhttps://github.com/elixir-tesla/tesla/commit/340f75b5d191dc747ef7ac6365bd002d1cd55a9dhttps://github.com/elixir-tesla/tesla/commit/5bd90bb5cf0d15e375edc2a66fa322292940fce2https://github.com/elixir-tesla/tesla/security/advisories/GHSA-mc85-72gr-vm9fhttps://osv.dev/vulnerability/EEF-CVE-2026-48594https://github.com/elixir-tesla/tesla/security/advisories/GHSA-mc85-72gr-vm9f
2026-06-02
Published