CVE-2026-48594

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-tesla tesla allows a denial of service via decompression bomb in HTTP response bodies. When Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression is included in a Tesla middleware pipeline, HTTP response bodies are decompressed eagerly with no size limit. The decompress_body/2 function in lib/tesla/middleware/compression.ex passes the entire response body to :zlib.gunzip/1 or :zlib.unzip/1 without any cap on the output size. Additionally, compression_algorithms/1 splits the content-encoding header on commas and decompress_body/2 recurses once per token, applying a decompression pass on each iteration. A server advertising content-encoding: gzip, gzip, gzip, gzip causes four recursive decompression passes, yielding exponential amplification: each gzip layer can expand its input roughly 1000x, so a payload of a few hundred bytes on the wire inflates to gigabytes of BEAM heap, exhausting memory and crashing or freezing the calling process. This issue affects tesla: from 0.6.0 before 1.18.3.

• CWE-409

• https://cna.erlef.org/cves/CVE-2026-48594.htmlThird Party Advisory
• https://github.com/elixir-tesla/tesla/commit/340f75b5d191dc747ef7ac6365bd002d1cd55a9dPatch
• https://github.com/elixir-tesla/tesla/commit/5bd90bb5cf0d15e375edc2a66fa322292940fce2
• https://github.com/elixir-tesla/tesla/security/advisories/GHSA-mc85-72gr-vm9fExploit, Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-48594Third Party Advisory
• https://github.com/elixir-tesla/tesla/security/advisories/GHSA-mc85-72gr-vm9fExploit, Vendor Advisory

Published

Jun 2, 2026

Last Modified

Sep 24, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48589Apache Shiro’s Jakarta EE module used the HTTP Referer heade…5.4
• CVE-2026-4859The SP Blog Designer plugin for WordPress is vulnerable to S…6.4
• CVE-2026-48590XML Injection vulnerability in joshnuss xml_builder (XmlBuil…2.1
• CVE-2026-48591Improper Neutralization of Script in Attributes in a Web Pag…4.8
• CVE-2026-48592Missing Authorization vulnerability in oban-bg oban_web ('El…5.3
• CVE-2026-48593Uncontrolled Resource Consumption vulnerability in oban-bg o…5.9
• CVE-2026-48595Improper Handling of Case Sensitivity vulnerability in elixi…5.9
• CVE-2026-48596Improper Neutralization of CRLF Sequences in HTTP Headers ('…3.7
• CVE-2026-48597Allocation of Resources Without Limits or Throttling vulnera…5.9
• CVE-2026-48598Improper Encoding or Escaping of Output vulnerability in eli…3.7
• CVE-2026-48599Authorization Bypass Through User-Controlled Key vulnerabili…7.6
• CVE-2026-4860A security flaw has been discovered in 648540858 wvp-GB28181…7.3