Elixir-Tesla Tesla vulnerabilities
5 known vulnerabilities affecting elixir-tesla/tesla.
Total CVEs
5
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH3LOW2
Vulnerabilities
Page 1 of 1
CVE-2026-48594P3HIGHCVSS 8.2≥ 0.6.0, < 1.18.3≥ 5bd90bb5cf0d15e375edc2a66fa322292940fce2, < 340f75b5d191dc747ef7ac6365bd002d1cd55a9d2026-06-02
CVE-2026-48594 [HIGH] CWE-409 CVE-2026-48594: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-tesla tesla
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-tesla tesla allows a denial of service via decompression bomb in HTTP response bodies.
When Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression is included in a Tesla middleware pipeline, HTTP response bodies are decompressed eagerly with no size
nvd
CVE-2026-48597P3HIGHCVSS 8.2≥ 1.3.0, < 1.18.3≥ ccd0823d4ba37581a37d8f6108f9a81b263237ef, < 4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e2026-06-02
CVE-2026-48597 [HIGH] CWE-770 CVE-2026-48597: Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows deni
Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.
Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-co
nvd
CVE-2026-48595P3HIGHCVSS 8.2≥ 1.4.0, < 1.18.3≥ 2d937d5813d7cda5cd726f41824985fb655c920f, < db963dba67651b9abd1fc420a1d9679cf6efe1822026-06-02
CVE-2026-48595 [HIGH] CWE-178 CVE-2026-48595: Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage
Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.
Tesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (@filter_headers ["authorization", "
nvd
CVE-2026-48596P4LOWCVSS 2.1≥ 0.8.0, < 1.18.3≥ 6ebfdb9abe9c6f119408045b933d82462decd351, < 23601edac5d22ba9407b427967b5bdbda201aec22026-06-02
CVE-2026-48596 [LOW] CWE-113 CVE-2026-48596: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulner
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.
Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\r) or
nvd
CVE-2026-48598P4LOWCVSS 2.1≥ 0.8.0, < 1.18.3≥ 6ebfdb9abe9c6f119408045b933d82462decd351, < bb1a2c3da2775924d96e3db8e315dcc4d5d2246e2026-06-02
CVE-2026-48598 [LOW] CWE-116 CVE-2026-48598: Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part he
Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values.
Tesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{k}="#{v}" with no validation of CR (\r), LF (\n), or double-quote characters. The values come
nvd