The vulnerability arises because Tesla’s middleware decompresses HTTP response bodies without imposing any size restriction. When Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression is used, the decompress_body/2 function hands the entire body to :zlib.gunzip/1 or :zlib.unzip/1 without limiting the expansion. If a attacker supplies a response with repeated gzip layers, each layer can inflate the data roughly 1,000 times, causing the process to consume gigabytes of BEAM heap and eventually crash or become unresponsive. This results in a denial‑of‑service condition for the client process.

Affected by this flaw are applications that depend on the elixir‑tesla library version 0.6.0 through 1.18.3 inclusive. The problem resides in Tesla version before 1.18.3 and was fixed in 1.18.3. Users running elixir‑tesla tesla in that version range should assess whether the middleware components are active in their HTTP client pipelines.

The CVSS score of 8.2 indicates a high‑severity impact, but the EPSS score is not available and the vulnerability is not listed in CISA KEV. The primary attack vector is likely a malicious HTTP response that an application receives. Because the middleware decompresses eagerly, any response with a crafted content‑encoding header such as “gzip, gzip, gzip, gzip” can trigger the recursive decompression and memory exhaustion. No authentication is required, so the attack could be performed by anyone who can send a response to the client.