Yordis Prieto

**Name of the Vulnerable Software and Affected Versions** tesla versions 0.6.0 through 1.18.2 **Description** Improper handling of highly compressed data allows a denial of service via a decompression bomb in HTTP response bodies. When `Tesla.Middleware.DecompressResponse` or `Tesla.Middleware.Compression` is included in a middleware pipeline, response bodies are decompressed eagerly without a size limit. Specifically, the `decompress body/2` function passes the entire response body to `:zlib.gunzip/1` or `:zlib.unzip/1` without capping the output size. Furthermore, the `compression algorithms/1` function splits the `content-encoding` header on commas, and `decompress body/2` recurses for each token. A server providing multiple gzip layers in the `content-encoding` header can cause exponential amplification, where a small payload inflates to gigabytes of BEAM heap, exhausting memory and crashing or freezing the process. **Recommendations** Update to version 1.18.3. As a temporary workaround, avoid including `Tesla.Middleware.DecompressResponse` or `Tesla.Middleware.Compression` in the Tesla middleware pipeline.

**Name of the Vulnerable Software and Affected Versions** tesla versions 1.4.0 through 1.18.2 **Description** Improper handling of case sensitivity in the `Tesla.Middleware.FollowRedirects` middleware allows credential leakage to third-party origins during cross-origin redirects. The system uses a case-sensitive string comparison against a lowercase filter list containing `authorization` and `host` to strip security-sensitive headers. However, because HTTP header names are case-insensitive per RFC 7230 and Tesla preserves header keys verbatim, headers using canonical casing, such as `Authorization`, do not match the lowercase filter and are forwarded to the redirect destination. An attacker capable of influencing a `Location:` response can capture bearer tokens or other authorization material. **Recommendations** Update to version 1.18.3. Normalize all header keys to lowercase before passing them to the software, specifically using `authorization` instead of `Authorization` when setting headers via `Tesla.put header/3` or `Tesla.Middleware.Headers`.

**Name of the Vulnerable Software and Affected Versions** tesla versions 0.8.0 through 1.18.2 **Description** Improper Neutralization of CRLF Sequences in HTTP Headers, also known as HTTP Request/Response Splitting, allows HTTP header injection. The function `add content type param/2` within the `Tesla.Multipart` module appends caller-supplied strings to the `content type params` list without validating for Carriage Return (`r`) or Line Feed (` `) characters. Subsequently, the `headers/1` function in `Tesla.Multipart` joins these parameters verbatim to construct the outgoing Content-Type header. If a parameter contains `r `, it splits the header line, enabling the injection of arbitrary headers into the outbound HTTP request. This occurs when an application forwards untrusted input, such as a user-supplied charset or parameter string, into the `add content type param/2` function. **Recommendations** Update to version 1.18.3 or later. As a temporary workaround, validate content-type parameter strings before passing them to the `add content type param/2` function, rejecting any value that contains `r` or ` `.

**Name of the Vulnerable Software and Affected Versions** tesla versions 1.3.0 through 1.18.2 **Description** An issue in Tesla.Adapter.Mint allows for a denial of service via atom table exhaustion. The function `open conn/2` converts the URL scheme of outgoing requests into a BEAM atom using `String.to atom(uri.scheme)` without allow-list validation. BEAM atoms are permanent entries that are not garbage-collected and are limited to a bounded table of approximately 1,048,576 entries. An attacker capable of influencing the request URL—through application-level URL-forwarding features like webhooks, proxies, or importers, or via a Location header when `Tesla.Middleware.FollowRedirects` is active—can create a new atom for each request by varying the scheme string. Once the atom table is full, the virtual machine crashes, resulting in a complete application shutdown. **Recommendations** Update to version 1.18.3.

**Name of the Vulnerable Software and Affected Versions** tesla versions 0.8.0 through 1.18.2 **Description** Improper encoding or escaping of output allows multipart part header injection through unescaped `Content-Disposition` parameter values. The function `part headers for disposition()` interpolates disposition parameters without validating carriage return (`r`), line feed (` `), or double-quote characters. These values are received from the caller via `add field()` (the `name` parameter), `add file()` (the `filename` parameter), and `add file content()` (the `filename` parameter and other disposition options). A double-quote character can close a quoted parameter prematurely, while `r ` sequences can terminate the `Content-Disposition` header to start a new forged header or end the header block to prepend bytes to the part body. Additionally, the default filename path in `add file()` uses `Path.basename()`, which does not strip carriage returns or line feeds. **Recommendations** Update to version 1.18.3. Validate disposition parameter values before passing them to `add field()`, `add file()`, or `add file content()`, rejecting any value containing `r`, ` `, or double-quotes.