PT-2026-45837 · Tesla · Tesla
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
tesla versions 0.6.0 through 1.18.2
Description
Improper handling of highly compressed data allows a denial of service via a decompression bomb in HTTP response bodies. When
Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression is included in a middleware pipeline, response bodies are decompressed eagerly without a size limit. Specifically, the decompress body/2 function passes the entire response body to :zlib.gunzip/1 or :zlib.unzip/1 without capping the output size. Furthermore, the compression algorithms/1 function splits the content-encoding header on commas, and decompress body/2 recurses for each token. A server providing multiple gzip layers in the content-encoding header can cause exponential amplification, where a small payload inflates to gigabytes of BEAM heap, exhausting memory and crashing or freezing the process.Recommendations
Update to version 1.18.3.
As a temporary workaround, avoid including
Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression in the Tesla middleware pipeline.Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tesla