Improper Handling of Compressed Data in Tesla by Elixir

CVE-2026-48594

What is CVE-2026-48594?

The vulnerability in the Tesla component of Elixir involves improper handling of highly compressed data, leading to denial of service. When the response bodies are processed in the middleware, the system decompresses them eagerly without enforcing size limits. This results in potential recursive decompression on content-encoding headers, allowing a small payload to expand exponentially and consume extensive memory resources. Thus, a server can advertise multiple layers of gzip compression causing significant memory exhaustion and crashing or freezing the process.

References