Is CVE-2026-48594 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48594 being exploited in the wild.

How severe is CVE-2026-48594?

High severity, with a CVSS score of 8.2, published 2 June 2026.

Which products and versions are affected?

elixir-tesla tesla >= 0.6.0, < 1.18.3.

Is there a fix for CVE-2026-48594?

A patch was published on 1.18.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48594 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48594?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48594: Elixir Tesla denial of service via decompression bomb in compression middleware

Q: Is there a fix for CVE-2026-48594?

A patch was published on 1.18.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48594 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-48594?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48594 · Severity: high · CVSS 8.2 · Published 2026-06-02

Tesla is a popular HTTP client library for the Elixir programming language. A vulnerability exists where the library fails to limit the size of decompressed data when receiving responses from a server. An attacker-controlled server can send a specially crafted, highly compressed 'decompression bomb' that expands to gigabytes in memory, causing the application to crash or freeze and resulting in a denial of service.

Quick answers

Is CVE-2026-48594 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48594 being exploited in the wild.
How severe is CVE-2026-48594?: High severity, with a CVSS score of 8.2, published 2 June 2026.
Which products and versions are affected?: elixir-tesla tesla >= 0.6.0, < 1.18.3.
Is there a fix for CVE-2026-48594?: A patch was published on 1.18.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48594 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48594?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the `Tesla.Middleware.DecompressResponse` and `Tesla.Middleware.Compression` components. The `decompress_body/2` function in `lib/tesla/middleware/compression.ex` recursively calls `:zlib.gunzip/1` or `:zlib.unzip/1` based on the `content-encoding` header without enforcing any output size limits. By providing multiple encoding tokens (e.g., 'gzip, gzip, gzip'), an attacker can achieve exponential data amplification. A small network payload can thus materialize as gigabytes of data on the BEAM heap, leading to memory exhaustion (CWE-409). The issue is fixed in version 1.18.3.

Affected products

elixir-tesla tesla >= 0.6.0, < 1.18.3

Identifiers

CVE-2026-48594
GHSA-mc85-72gr-vm9f

Timeline

2026-06-02: disclosed: Initial disclosure and NVD publication
2026-07-10: advisory: GitHub Advisory published/reviewed
1.18.3: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.