tesla (Hex)
Advisories
10
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.18.3 or later clears every advisory below that has a fix.
Upgrade commands
mix
{:tesla, "~> 1.18.3"} # then: mix deps.update teslaKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| EEF-CVE-2026-48596 CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection |
Low EPSS 0.24% |
>= 0.8.0, < 1.18.3 | 1.18.3 |
| EEF-CVE-2026-48596 CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection |
Low EPSS 0.24% |
>= 0.8.0, < 1.18.3 | 1.18.3 |
| EEF-CVE-2026-48594 Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression |
High EPSS 0.46% |
>= 0.6.0, < 1.18.3 | 1.18.3 |
| EEF-CVE-2026-48594 Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression |
High EPSS 0.46% |
>= 0.6.0, < 1.18.3 | 1.18.3 |
| EEF-CVE-2026-48595 Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects |
Medium EPSS 0.49% |
>= 1.4.0, < 1.18.3 | 1.18.3 |
| EEF-CVE-2026-48595 Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects |
Medium EPSS 0.49% |
>= 0.6.0, < 1.18.3 | 1.18.3 |
| EEF-CVE-2026-48597 Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint |
Medium EPSS 0.35% |
>= 1.3.0, < 1.18.3 | 1.18.3 |
| EEF-CVE-2026-48597 Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint |
Medium EPSS 0.35% |
>= 1.3.0, < 1.18.3 | 1.18.3 |
| GHSA-28jh-g32x-v9v4 CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection |
Low EPSS 0.27% |
>= 0.8.0, < 1.18.3 | 1.18.3 |
| GHSA-28jh-g32x-v9v4 CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection |
Low EPSS 0.27% |
>= 0.8.0, < 1.18.3 | 1.18.3 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor