Threat Intelligence Database

CVE-2026-48596 is a low-severity vulnerability in the elixir-tesla tesla library affecting versions from 0.8.0 up to but not including 1.18.3. It involves improper neutralization of CRLF sequences in HTTP headers, specifically in the Tesla.Multipart.add_content_type_param/2 function. This function appends user-supplied strings to the content_type_params list without validating for carriage return or line feed characters, allowing HTTP header injection via header splitting. Applications that forward untrusted input into this function are vulnerable.

A vulnerability in elixir-tesla's tesla library allows denial of service via decompression bomb attacks. When certain middleware decompress HTTP response bodies, there is no limit on decompressed size, enabling exponential memory amplification. This can crash or freeze the process handling the response. The issue affects version 0.6.0 and versions before 1.18.3.

A vulnerability in elixir-tesla tesla (version 1.4.0) allows credential leakage due to improper handling of case sensitivity in HTTP headers during cross-origin redirects. The middleware FollowRedirects uses a case-sensitive comparison to strip sensitive headers, but HTTP headers are case-insensitive per RFC 7230. This causes headers like "Authorization" with canonical casing to bypass filtering and be sent to unintended third-party origins.

CVE-2026-48597 is a high-severity vulnerability in the elixir-tesla tesla library affecting version 1.3.0. It involves allocation of resources without limits or throttling, specifically the conversion of URL schemes to BEAM atoms without validation. Because BEAM atoms are not garbage-collected and the atom table has a fixed size, an attacker can exhaust this table by causing many unique URL schemes to be converted, leading to a denial of service by crashing the Erlang VM.

CVE-2026-48598 is a low-severity vulnerability in the elixir-tesla tesla library affecting versions 0.8.0 up to but not including 1.18.3. It involves improper encoding or escaping of output in multipart part headers, allowing injection via unescaped Content-Disposition parameter values. This occurs because the library interpolates disposition parameters without validating carriage return, line feed, or double-quote characters, enabling header injection. The issue can arise when attacker-controlled input is passed as filename or disposition parameters, potentially leading to forged headers or malformed multipart bodies.