{"metadata": {"vulnerability": "CVE-2026-48594", "count": 16, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-05-22T09:36:56.834Z", "date_only": false, "value": "2026-05-22T09:36:56.834Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-48594", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-06-02T19:08:49Z", "date_only": false, "value": "2026-06-02T19:08:49.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / EEF", "record": "CVE-2026-48594", "field": "containers.cna.datePublic"}, {"timestamp": "2026-06-02T19:08:49.596Z", "date_only": false, "value": "2026-06-02T19:08:49.596Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-48594", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-06-02T20:16:38Z", "date_only": false, "value": "2026-06-02T20:16:38Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MC85-72GR-VM9F", "record": "GHSA-MC85-72GR-VM9F", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-06-02T20:16:38.193Z", "date_only": false, "value": "2026-06-02T20:16:38.193", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48594", "record": "FKIE_CVE-2026-48594", "field": "published"}, {"timestamp": "2026-06-02T21:29:20.103Z", "date_only": false, "value": "2026-06-02T21:29:20.103045Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mndk2jnfci2o", "record": "CVE-2026-48594", "field": "creation_timestamp", "uuid": "d6c4bf2f-ab0c-449c-ab48-58af2f946100", "content": "CVE-2026-48594 - Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression\nCVE ID : CVE-2026-48594\n \n Published : June 2, 2026, 7:08 p.m. | 1\u00a0hour, 16\u00a0minutes ago\n \n Description : Improper Handling of Highly Compressed Data (Data Amplification)...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mndk2jnfci2o"}, {"timestamp": "2026-06-03T14:39:48.594Z", "date_only": false, "value": "2026-06-03T14:39:48.594599Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-48594", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-06-03T14:39:48.594Z", "date_only": false, "value": "2026-06-03T14:39:48.594599Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48594", "record": "FKIE_CVE-2026-48594", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-06-03T14:39:54.578Z", "date_only": false, "value": "2026-06-03T14:39:54.578Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-48594", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-10T00:03:23Z", "date_only": false, "value": "2026-07-10T00:03:23Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MC85-72GR-VM9F", "record": "GHSA-MC85-72GR-VM9F", "field": "published"}, {"timestamp": "2026-07-10T00:03:23Z", "date_only": false, "value": "2026-07-10T00:03:23Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MC85-72GR-VM9F", "record": "GHSA-MC85-72GR-VM9F", "field": "modified"}, {"timestamp": "2026-07-10T02:12:08.091Z", "date_only": false, "value": "2026-07-10T02:12:08.091772Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/771904cdd1d35750b64c7a038f4ce112", "record": "CVE-2026-48594", "field": "creation_timestamp", "uuid": "68072a44-577a-4dbb-a687-2d0ec520c1cf", "content": "# CVE-2026-48594: CVE-2026-48594: Decompression Bomb Denial of Service in Elixir Tesla HTTP Client\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-07-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48594\n\n## Summary\nAn improper handling of highly compressed data (decompression bomb) vulnerability exists in the Elixir Tesla HTTP client when utilizing response decompression middlewares. By serving highly compressed responses or stacked content-encoding headers, a malicious server can cause arbitrary heap exhaustion, leading to a denial of service (DoS) crash in the BEAM virtual machine.\n\n## TL;DR\nUnrestricted decompression and recursive codec handling in Tesla's decompression middleware allow remote servers to trigger heap exhaustion and BEAM VM crashes via tiny, highly compressed response payloads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-409\n- **Attack Vector**: Network\n- **CVSS Score**: 8.2 (High)\n- **EPSS Score**: 0.00329 (Percentile: 24.87%)\n- **Impact**: Denial of Service (OOM Crash)\n- **Exploit Status**: Theoretical / Patch Analysis\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Elixir Applications deploying Tesla client pipelines with DecompressResponse or Compression middleware active.\n- **tesla**: >= 0.6.0, < 1.18.3 (Fixed in: `1.18.3`)\n\n## Mitigation\n\n- Upgrade Tesla dependency to 1.18.3 or higher.\n- Enforce mandatory :max_body_size limits in middleware options.\n- Avoid handling decompression of external data with unconstrained endpoints.\n- Deploy network-level HTTP header filtering to drop stacked Content-Encodings.\n\n**Remediation Steps:**\n1. Open your project mix.exs file and locate the :tesla dependency.\n2. Update the version constraint to {:tesla, \"~> 1.18.3\"} or higher.\n3. Run mix deps.get to download and lock the updated version.\n4. Locate modules utilizing Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression.\n5. Append max_body_size:  configuration parameter.\n6. Re-compile and run test suites to ensure integration compatibility.\n\n## References\n\n- [GitHub Advisory GHSA-mc85-72gr-vm9f](https://github.com/elixir-tesla/tesla/security/advisories/GHSA-mc85-72gr-vm9f)\n- [Official Fix Commit](https://github.com/elixir-tesla/tesla/commit/340f75b5d191dc747ef7ac6365bd002d1cd55a9d)\n- [CVE-2026-48594 Record](https://www.cve.org/CVERecord?id=CVE-2026-48594)\n- [NVD CVE-2026-48594 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-48594)\n- [EEF/CNA Advisory Portal](https://cna.erlef.org/cves/CVE-2026-48594.html)\n- [OSV Entry for EEF-CVE-2026-48594](https://osv.dev/vulnerability/EEF-CVE-2026-48594)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48594) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/771904cdd1d35750b64c7a038f4ce112"}, {"timestamp": "2026-07-10T02:35:10.408Z", "date_only": false, "value": "2026-07-10T02:35:10.408608Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-mc85-72gr-vm9f", "record": "CVE-2026-48594", "field": "creation_timestamp", "uuid": "1ee962a2-bddc-47ac-aeae-e81b5a5aa976", "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-mc85-72gr-vm9f"}, {"timestamp": "2026-09-24T20:50:12.704Z", "date_only": false, "value": "2026-09-24T20:50:12.704Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-48594", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-24T20:50:12.704Z", "date_only": false, "value": "2026-09-24T20:50:12.704Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / EEF", "record": "CVE-2026-48594", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-24T21:17:12.963Z", "date_only": false, "value": "2026-09-24T21:17:12.963", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48594", "record": "FKIE_CVE-2026-48594", "field": "lastModified"}]}