The elixir-tesla tesla library versions from 0.6.0 before 1.18.3 contain a CWE-409 vulnerability due to improper handling of highly compressed data in HTTP response bodies. When Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression is used, the decompress_body/2 function passes the entire response body to :zlib.gunzip/1 or :zlib.unzip/1 without any output size limit. Additionally, the function recursively decompresses each token in the content-encoding header, which can lead to exponential amplification if multiple gzip layers are present. For example, a server sending a content-encoding header with multiple gzip entries can cause the decompressed data to expand by roughly 1000x per layer, resulting in gigabytes of memory usage that exhausts the BEAM heap and causes denial of service.

This vulnerability allows an attacker to cause a denial of service by sending HTTP responses with multiple layers of gzip compression, which the tesla library decompresses recursively without size limits. This leads to exponential memory amplification, exhausting the memory of the process and causing it to crash or freeze. There is no indication of remote code execution or data disclosure from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented in the provided data. Until a patch is available, users should avoid using Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression with untrusted HTTP responses or implement external safeguards to limit decompression size. Monitor vendor communications for updates regarding an official fix.