Tesla (Elixir HTTP client) CVE-2026-48594

The target application must (1) use the elixir-tesla 'tesla' library at any version from 0.6.0 through 1.18.2, (2) include Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression in the middleware pipeline of the affected client, and (3) issue an HTTP request to a server an attacker controls or can tamper with - directly (outbound fetch of attacker-supplied URLs, SSRF, webhook callbacks, federation) or via an on-path MITM of an unencrypted or compromised TLS channel. The vulnerable server response is a small body compressed with gzip or deflate combined with a content-encoding header that either advertises a single deeply-nested gzip stream or stacks codecs (e.g. 'gzip, gzip, gzip, gzip') to trigger recursive amplification. HEAD-method requests are not affected. No authentication, user interaction, or non-default configuration on the Tesla client side beyond having decompression middleware enabled (which is the documented and common pattern) is required.

CVSS 4.0 vector AV:N/AC:L/AT:P/PR:N/UI:N rates this as network-reachable, low complexity, requiring no privileges or user interaction, with the only impact being high availability loss (VA:H, VC:N, VI:N) - score 8.2. The AT:P (attack requirements: present) flag correctly captures that the victim must initiate or follow an HTTP request to an attacker-controlled (or attacker-influenced) endpoint while the Compression/DecompressResponse middleware is enabled. EPSS and CISA KEV data were not supplied; no public exploit identified at time of analysis, though the malicious-server pattern is trivially reproducible from the public commit diff. Real-world priority is high for any backend service that uses Tesla to fetch URLs supplied by users, partners, or webhooks (SSRF-style call paths, scrapers, federation), and moderate for clients that only contact a fixed list of trusted endpoints. Note: the description mentions 'remote' but the practical reach depends on whether the application calls untrusted servers - defenders should verify exposure rather than assume internet-wide reachability.

An attacker who controls or can MITM a URL that a Tesla-based Elixir service fetches (a webhook target, scraped page, federated peer, SSRF-reachable host) returns a few hundred bytes of gzip-compressed data with a content-encoding header of 'gzip, gzip, gzip, gzip'. The DecompressResponse middleware recursively gunzips four times into multi-gigabyte iodata in BEAM heap, OOM-killing the worker or freezing the node. No POC is published, but the malicious-server payload is straightforward to construct from the patch diff and the AV:N/AC:L/PR:N/UI:N CVSS profile means no authentication or user click is required once the request is initiated.