Hex/tesla CVE-2026-48594: high 7.5, EPSS 0.46%
Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression
Action: Upgrade tesla to 1.18.3 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.6.0 | 1.18.3 | - |
Fixed versions
| 1.18.3 |
Sources
- osv: EEF-CVE-2026-48594
- nvd: CVE-2026-48594
- https://github.com/elixir-tesla/tesla/security/advisories/GHSA-mc85-72gr-vm9f
- https://cna.erlef.org/cves/CVE-2026-48594.html
- https://github.com/elixir-tesla/tesla/commit/5bd90bb5cf0d15e375edc2a66fa322292940fce2
- https://github.com/elixir-tesla/tesla/commit/340f75b5d191dc747ef7ac6365bd002d1cd55a9d
- https://hex.pm/packages/tesla
CVE-2026-48594 · published · modified · JSON