The elixir-tesla tesla library improperly handles highly compressed HTTP response bodies when using Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression. The decompress_body/2 function decompresses data eagerly without limiting output size, passing the entire response body to :zlib.gunzip/1 or :zlib.unzip/1. Additionally, multiple content-encoding headers cause recursive decompression passes, exponentially amplifying memory usage. For example, a response with content-encoding: gzip, gzip, gzip, gzip causes four decompression passes, each expanding roughly 1000x, which can inflate a small payload into gigabytes of memory usage, leading to denial of service by exhausting the BEAM heap and crashing or freezing the process. This affects tesla versions from 0.6.0 up to but not including 1.18.3.

An attacker can craft HTTP responses with multiple layers of compression to cause exponential memory amplification during decompression. This leads to denial of service by exhausting memory resources, crashing, or freezing the application process using the tesla library. No remote code execution or data disclosure is described.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression with untrusted or potentially malicious HTTP responses. Implement application-level limits on decompressed response size if possible to mitigate memory exhaustion.