Executive Summary

CVE-2026-48594 is a vulnerability in the elixir-tesla library that involves improper handling of highly compressed data, specifically a decompression bomb attack.

When the Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression middleware is used, HTTP response bodies are decompressed eagerly without any size limit.

The decompress_body/2 function passes the entire response body to decompression functions without capping the output size, and recursively decompresses each content-encoding token.

This recursive decompression can cause exponential amplification, where a small compressed payload expands to gigabytes of memory usage, exhausting system resources and crashing or freezing the process.

For example, a server advertising multiple gzip encodings (like "gzip, gzip, gzip, gzip") can cause four decompression passes, each expanding roughly 1000x, leading to massive memory consumption.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a denial-of-service (DoS) condition by exhausting memory resources on the BEAM virtual machine.

An attacker-controlled server can send a small compressed response that expands exponentially when decompressed, consuming gigabytes of memory.

This excessive memory usage can crash or freeze the affected application process or node, causing service disruption.

The vulnerability requires no special privileges and can be triggered remotely via network requests.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusually high memory usage or crashes in applications using the elixir-tesla library, especially when processing HTTP responses with multiple gzip content-encoding layers.

Since the vulnerability involves decompression bombs in HTTP response bodies, network detection can focus on identifying HTTP responses with suspiciously repeated or multiple gzip content-encoding headers, such as "gzip, gzip, gzip, gzip".

Commands to detect this might include network traffic inspection tools like tcpdump or Wireshark to filter HTTP responses with multiple gzip encodings, for example:

• tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i 'content-encoding: gzip'
• Using Wireshark, apply a display filter for HTTP responses and inspect the Content-Encoding header for multiple gzip entries.

On the application side, enabling detailed logging around Tesla HTTP client middleware decompression steps and monitoring for Tesla.Middleware.Compression.Error exceptions related to max_body_size_exceeded (if the fix is applied) can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary immediate mitigation is to upgrade the elixir-tesla library to version 1.18.3 or later, where the vulnerability is fixed.

The fix introduces a mandatory :max_body_size option that limits the decompressed response size, preventing memory exhaustion from decompression bombs.

Additionally, the updated middleware rejects HTTP responses advertising multiple compression codecs, which are commonly used in decompression bomb attacks.

If upgrading immediately is not possible, consider implementing network-level controls to block or inspect HTTP responses with suspicious multiple gzip content-encoding headers.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0