Vulnerabilities

TI-2026-35952 CVE-2026-48596 · GHSA-q7jx-v53g-848w

CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection

MEDIUM 44

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.

CVSS 4.0LOW 2.1 Local No auth No interaction EPSS 0.00239 Published 2026-06-02 Fixed in 1.18.3 CWE-113

TI-2026-35950 CVE-2026-48594 · GHSA-mc85-72gr-vm9f

Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression

LOW 36

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-tesla tesla allows a denial of service via decompression bomb in HTTP response bodies.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00455 Published 2026-06-02 Fixed in 1.18.3 CWE-409

TI-2026-35951 CVE-2026-48595 · GHSA-9m9w-gxf7-rh8m

Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects

HIGH 69

Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00487 Published 2026-06-02 Fixed in 1.18.3 CWE-178

TI-2026-35953 CVE-2026-48597 · GHSA-h74c-q9j7-mpcm

Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint

HIGH 69

Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00347 Published 2026-06-02 Fixed in 1.18.3 CWE-770

TI-2026-35954 CVE-2026-48598 · GHSA-28jh-g32x-v9v4

CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection