CVE-2026-48594: Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression

Synopsis

A decompression bomb vulnerability in the elixir-tesla HTTP client library (versions 0.6.0 through 1.18.3) allows a malicious or compromised remote server to exhaust the memory of any Elixir process using the Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression middleware. The vulnerability is exploitable over the network with no authentication required: the attacker controls an HTTP server that returns a response with stacked content-encoding headers (e.g., gzip repeated multiple times), triggering recursive decompression passes that amplify a few hundred bytes on the wire into gigabytes on the BEAM heap. Successful exploitation crashes or freezes the calling process, causing a denial of service. A patched-image rebuild at version 1.18.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must operate or control an HTTP server reachable over the network by the application using tesla, since the malicious payload is delivered in an HTTP response body.

• AuthenticationNot required

  No authentication is needed; the vulnerability is triggered by any HTTP response the tesla client receives, regardless of whether the upstream endpoint requires credentials.

• Victim interactionNot required

  No user interaction is required; the vulnerable decompression path executes automatically when the tesla middleware processes an incoming response.

• Attack complexityDetail

  The exploit is reliable in principle (AC:L), but an attacker-controlled precondition is needed (AT:P): the calling application must make an outbound HTTP request to a server the attacker controls or can influence, such as a third-party API endpoint that has been compromised.

Blast Radius

• Crashes or freezes the Elixir process making the HTTP request, taking that process out of service for the duration of the attack.
• Heap exhaustion on the BEAM VM can propagate beyond the calling process, destabilizing or crashing the entire OTP application if memory limits are reached.
• Availability of any feature or service that depends on the affected tesla client is disrupted; there is no confidentiality or data-integrity impact.