DEV Community: CVE Reports

CVE-2026-49866: CVE-2026-49866: CPU-Based Denial of Service in @libp2p/gossipsub Protobuf Parser

CVE Reports — Fri, 10 Jul 2026 16:40:59 +0000

CVE-2026-49866: CPU-Based Denial of Service in @libp2p/gossipsub Protobuf Parser

Vulnerability ID: CVE-2026-49866
CVSS Score: 7.5
Published: 2026-07-10

A high-severity denial-of-service vulnerability in @libp2p/gossipsub prior to version 16.0.0 allows unauthenticated remote attackers to trigger event loop starvation and complete node freeze by exploiting unbounded protobuf decoding limits and nested synchronous array iteration loops.

TL;DR

Unbounded protobuf limits and synchronous array loops in @libp2p/gossipsub allow unauthenticated remote attackers to block the single-threaded Node.js event loop, causing a complete denial of service.

Technical Details

CWE ID: CWE-770
Attack Vector: Network (AV:N)
CVSS Score: 7.5
EPSS Score: 0.00446
Exploit Status: poc
KEV Status: not-listed

Affected Systems

@libp2p/gossipsub prior to 16.0.0
js-libp2p installations using vulnerable @libp2p/gossipsub modules

Mitigation Strategies

Upgrade dependency @libp2p/gossipsub to version 16.0.0 or above
Configure explicit decodeRpcLimits in GossipSub initialization option block
Implement event loop lag monitoring in the application infrastructure

Remediation Steps:

Identify vulnerable @libp2p/gossipsub references in package.json or package-lock.json
Execute the upgrade to version 16.0.0 or higher
Alternatively, modify instantiation properties to override default limits manually
Deploy telemetry to capture event loop blocking spikes

Read the full report for CVE-2026-49866 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-49858: CVE-2026-49858: Cross-User Attribute and Relation Leak in API Platform Core Serializers

CVE Reports — Fri, 10 Jul 2026 15:41:01 +0000

CVE-2026-49858: Cross-User Attribute and Relation Leak in API Platform Core Serializers

Vulnerability ID: CVE-2026-49858
CVSS Score: 5.9
Published: 2026-07-10

CVE-2026-49858 is a vulnerability in API Platform Core's JSON:API and HAL item normalizers where conditionally secured attributes are cached globally in memory. When deployed in long-running PHP execution environments such as FrankenPHP worker mode, Swoole, or RoadRunner, this persistent caching bypasses property-level security constraints, allowing unprivileged users to access sensitive, unauthorized fields cached during privileged requests.

TL;DR

Unsafe in-memory caching in API Platform Core's JSON:API and HAL normalizers leaks sensitive properties across different user contexts when running under persistent PHP environments like FrankenPHP or RoadRunner.

Technical Details

CWE ID: CWE-524
Attack Vector: Network (AV:N)
CVSS v3.1: 5.9 (Medium)
EPSS Score: 0.00197
Impact: High Confidentiality Exposure
Exploit Status: None (No public exploit or PoC)
KEV Status: Not Listed

Affected Systems

API Platform Core
api-platform/core
api-platform/hal
api-platform/json-api
api-platform/core: >= 4.1.0, < 4.1.29 (Fixed in: 4.1.29)
api-platform/core: >= 4.2.0, < 4.2.26 (Fixed in: 4.2.26)
api-platform/core: >= 4.3.0, < 4.3.12 (Fixed in: 4.3.12)

Code Analysis

Commit: 019fd90

fix(serializer): gate cache_key in JsonApi and Hal with isCacheKeySafe

diff --git a/src/JsonApi/Serializer/ItemNormalizer.php b/src/JsonApi/Serializer/ItemNormalizer.php
index a093a17..dfc4a17 100644
--- a/src/JsonApi/Serializer/ItemNormalizer.php
+++ b/src/JsonApi/Serializer/ItemNormalizer.php
@@ -34,3 +34,3 @@
         if (!isset($context['cache_key'])) {
-            $context['cache_key'] = $this->getCacheKey($format, $context);
+            $context['cache_key'] = $this->isCacheKeySafe($context) ? $this->getCacheKey($format, $context) : false;
         }

Commit: 1bfd6ee

refactor(serializer): bump static analysis rules and optimize cache security key evaluation

diff --git a/src/Serializer/AbstractItemNormalizer.php b/src/Serializer/AbstractItemNormalizer.php

Mitigation Strategies

Upgrade the API Platform Core package to version 4.1.29, 4.2.26, 4.3.12 or higher.
Temporarily disable persistent application workers (FrankenPHP worker mode, Swoole, RoadRunner) and fallback to stateless PHP-FPM runtime environments.
Decorate the SerializerContextBuilder to explicitly nullify the cache_key parameter during serialization of HAL and JSON:API formats.

Remediation Steps:

Run 'composer update api-platform/core' to pull the latest security patch.
Verify the installed version of API Platform Core using 'composer show api-platform/core'.
Restart long-running persistent PHP worker processes to purge any compromised cache states from memory.

References

Read the full report for CVE-2026-49858 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-5078: CVE-2026-5078: Log Forging and Injection via :remote-user Token in Morgan Logging Middleware

CVE Reports — Fri, 10 Jul 2026 15:11:32 +0000

CVE-2026-5078: Log Forging and Injection via :remote-user Token in Morgan Logging Middleware

Vulnerability ID: CVE-2026-5078
CVSS Score: 5.3
Published: 2026-07-10

CVE-2026-5078 is a log injection vulnerability in Morgan, the widely deployed Node.js HTTP request logging middleware. The vulnerability arises because the ':remote-user' logging token decodes and outputs basic authentication usernames containing control characters, such as Carriage Return (CR) and Line Feed (LF), without sanitization. An unauthenticated attacker can bypass native HTTP header parsers by Base64-encoding CRLF sequences in the Authorization header. When Morgan logs the request, these control characters force newlines in the log stream, enabling log forging, SIEM evasion, and system activity spoofing.

TL;DR

Unauthenticated remote log injection in Morgan middleware (versions 1.2.0-1.10.1) due to improper sanitization of basic authentication credentials. Upgrading to version 1.11.0 remediates the vulnerability.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-117 (Improper Output Neutralization for Logs)
Attack Vector: Network (Remote, Unauthenticated)
CVSS v3.1 Score: 5.3 (Medium)
EPSS Score: 0.00246
Exploit Status: Proof-of-Concept
CISA KEV Status: Not Listed

Affected Systems

Node.js applications using Morgan middleware versions 1.2.0 through 1.10.1 configured with log formats that include the :remote-user token.
morgan: >= 1.2.0, <= 1.10.1 (Fixed in: 1.11.0)

Code Analysis

Commit: b3f5d9b

Introduces escapeLogField private utility to escape control characters and backslashes for line-oriented logs, and wraps remote-user token outputs.

Commit: e0e6f17

Release commit for version 1.11.0, including unit test updates to prevent log injection regressions.

Exploit Details

GitHub Security Advisory: Proof of concept showcasing unit tests and raw payloads to trigger unescaped carriage returns and log parsing issues.

Mitigation Strategies

Upgrade the Morgan middleware to version 1.11.0 or later to ensure automatic escaping of control characters.
Modify custom Morgan logging configurations to exclude the :remote-user token if immediate patching is not possible.
Deploy Web Application Firewall (WAF) rules to inspect and decode the Authorization: Basic header, blocking requests containing raw CRLF characters.

Remediation Steps:

Identify all Node.js projects utilizing the morgan npm package.
Verify the installed version of morgan using 'npm list morgan' or checking package-lock.json.
Update the dependency to version 1.11.0 or higher by running 'npm install morgan@1.11.0' or 'npm update morgan'.
If unable to update, replace pre-built 'combined' or 'common' log formats with custom strings excluding the ':remote-user' token.
Deploy and test log-monitoring queries to detect escaped sequence signatures 'u0000', 'u001f', or '\r\n' in system logs.

References

Read the full report for CVE-2026-5078 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-48861: CVE-2026-48861: HTTP Request Splitting and Smuggling via Method Parameter CRLF Injection in Elixir Mint

CVE Reports — Fri, 10 Jul 2026 04:11:02 +0000

CVE-2026-48861: HTTP Request Splitting and Smuggling via Method Parameter CRLF Injection in Elixir Mint

Vulnerability ID: CVE-2026-48861
CVSS Score: 2.1
Published: 2026-07-09

CVE-2026-48861 is a client-side HTTP request-line CRLF (Carriage Return Line Feed) injection vulnerability in the popular Elixir HTTP client library, Mint. The vulnerability permits HTTP Request Splitting and HTTP Request Smuggling when an application forwards untrusted, attacker-controlled inputs to Mint's HTTP client requests as either the HTTP request method or target. By embedding CRLF characters within these parameters, an attacker can terminate the request line prematurely, inject malicious headers, or pipeline entirely independent requests. These smuggled requests are then processed by upstream or downstream proxy servers as separate HTTP queries on the same TCP connection. While Mint version 1.7.0 introduced target validation to secure the request target, the HTTP request method parameter remained completely unvalidated. This flaw allows attackers to bypass routing filters, access restricted internal APIs, or poison HTTP caches under default configurations.

TL;DR

A CRLF injection vulnerability in Elixir Mint (CVE-2026-48861) allows attackers to perform HTTP Request Splitting and Smuggling by passing control characters in the unvalidated HTTP method parameter.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-93 (Improper Neutralization of CRLF Sequences)
Attack Vector: Network / Client-Side forwarding
CVSS Score: 2.1 (Low Severity)
EPSS Score: 0.00166 (0.17% probability)
Impact: HTTP Request Splitting / HTTP Request Smuggling
Exploit Status: Proof-of-Concept (PoC)
KEV Status: Not Listed

Affected Systems

Elixir Mint library versions 0.1.0 through 1.8.1
Elixir applications utilizing dynamic, user-controlled HTTP methods with Mint
mint: >= 0.1.0, < 1.9.0 (Fixed in: 1.9.0)

Code Analysis

Commit: fad0914

Introduce token validation for the HTTP method in the request line to prevent CRLF injection

@@ -7,6 +7,7 @@ def encode(method, target, headers, body) do
+   validate_method!(method)
+
    body = [
      encode_request_line(method, target),
      encode_headers(headers),
@@ -34,6 +35,14 @@ defp validate_method!(method) do
+    _ =
+      for <<char <- method>> do
+        unless is_tchar(char) do
+          throw({:mint, {:invalid_request_method, method}})
+        end
+      end
+
+    :ok
+  end

Exploit Details

GitHub Security Advisory: Advisory containing details and verification cases for the CRLF injection vulnerability

Mitigation Strategies

Upgrade the Mint dependency to version 1.9.0 or higher to enforce token validation at the library level
Implement strict, application-level whitelisting for all dynamic HTTP method inputs before they are passed to Mint
Employ static application security testing (SAST) tools to audit dependencies and identify vulnerable packages

Remediation Steps:

Open the mix.exs configuration file in the affected Elixir project
Locate the mint dependency entry and update the version requirement to {:mint, "~> 1.9"}
Execute the mix deps.get command in the project directory to retrieve the updated package
Run mix deps.compile mint to ensure the patched version compiles correctly in the local environment
Deploy the updated application to production environments and monitor application logs for invalid request method exceptions

References

Read the full report for CVE-2026-48861 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-49753: CVE-2026-49753: HTTP Request/Response Smuggling via Inconsistent Content-Length Parsing in Elixir Mint Client

CVE Reports — Fri, 10 Jul 2026 03:40:59 +0000

CVE-2026-49753: HTTP Request/Response Smuggling via Inconsistent Content-Length Parsing in Elixir Mint Client

Vulnerability ID: CVE-2026-49753
CVSS Score: 6.3
Published: 2026-07-09

An Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) vulnerability in the Elixir Mint HTTP client allows attacker-controlled HTTP/1 servers to desynchronize response framing on shared connections due to over-lenient parsing of sign-prefixed Content-Length headers.

TL;DR

Elixir Mint's parser accepted sign-prefixed Content-Length values (like '+100') due to using Integer.parse/1. Intermediaries strictly enforcing RFC 7230/9110 reject or reframe these headers, enabling HTTP response smuggling and connection poisoning.

Technical Details

CWE ID: CWE-444
Attack Vector: Network
CVSS v4.0: 6.3
EPSS Score: 0.00301
Impact: HTTP Request/Response Smuggling
Exploit Status: None
KEV Status: Not Listed

Affected Systems

elixir-mint/mint
mint: >= 0.1.0, < 1.9.0 (Fixed in: 1.9.0)

Code Analysis

Commit: 47e4802

Strictly validate Content-Length header to contain only digits to mitigate HTTP request smuggling.

Commit: 65e0e86

Historical commit in ancestor library xhttp containing the vulnerable parsing pattern.

Mitigation Strategies

Update elixir-mint/mint to version 1.9.0 or later.
Deploy strict WAF rules to drop sign-prefixed Content-Length headers.
Avoid connection pooling across distinct security context boundaries when interacting with untrusted upstream hosts.

Remediation Steps:

Identify projects using Mint by auditing mix.lock.
Update mix.exs dependencies to require {:mint, '~> 1.9.0'}.
Run mix deps.get to fetch the patched version.
Validate HTTP header processing in downstream environments to ensure strict RFC compliance.

References

Read the full report for CVE-2026-49753 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-49754: CVE-2026-49754: Denial of Service via Unbounded HTTP/2 CONTINUATION Frame Accumulation in Elixir Mint

CVE Reports — Fri, 10 Jul 2026 03:11:00 +0000

CVE-2026-49754: Denial of Service via Unbounded HTTP/2 CONTINUATION Frame Accumulation in Elixir Mint

Vulnerability ID: CVE-2026-49754
CVSS Score: 8.2
Published: 2026-07-09

An allocation of resources without limits or throttling vulnerability in Elixir Mint allows an attacker-controlled HTTP/2 server to exhaust memory in a Mint client. The vulnerability is exploited by sending a HEADERS frame without the END_HEADERS flag followed by an infinite stream of CONTINUATION frames. Because the client lacks limits on the incoming header-block accumulator, the client continuously consumes memory until an out-of-memory crash occurs.

TL;DR

An unauthenticated, remote attacker can crash any Elixir application utilizing the Mint client library to establish HTTP/2 connections by hosting a malicious server that streams an infinite series of HTTP/2 CONTINUATION frames.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-770
Attack Vector: Network
CVSS v4.0 Score: 8.2 (High)
Exploit Maturity: Proof-of-Concept (PoC)
EPSS Score: 0.00384
CISA KEV Status: Not Listed

Affected Systems

Applications utilizing the Elixir Mint HTTP client library for outbound HTTP/2 connections.
mint: >= 0.1.0, < 1.9.0 (Fixed in: 1.9.0)

Code Analysis

Commit: b662d12

Bound size of accumulated header blocks to protect against HTTP/2 CONTINUATION floods

@@ -156,6 +156,12 @@ defmodule Mint.HTTP2 do
   @default_max_frame_size 16_384
   @valid_max_frame_size_range @default_max_frame_size..16_777_215

+  # Default cap on the size of an inbound header block.
+  @default_max_header_list_size 256 * 1024

Exploit Details

GitHub Security Advisory: Official replication details verified by Mint maintainers via integrated project unit tests, showing OOM crashes after approximately 64,000 continuous frames.

Mitigation Strategies

Upgrade the Mint library dependency to version 1.9.0 or higher.
Restrict connection protocols to HTTP/1.1 when connecting to external or untrusted endpoints to bypass the HTTP/2 continuation frame logic.
Implement deep packet inspection or proxy limits on outbound HTTP/2 connections to enforce strict limits on continuous framing sequences.

Remediation Steps:

Open the Elixir project configuration file mix.exs.
Locate the deps definition and update the mint dependency requirement to version ~> 1.9.
Run mix deps.get in your development terminal to download and integrate the updated version.
Deploy the updated application build to production environments.
For temporary emergency mitigations, modify connection calls in the application code to use the configuration option protocols: [:http1].

References

Read the full report for CVE-2026-49754 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-48596: CVE-2026-48596: Improper Neutralization of CRLF Sequences in Elixir Tesla Multipart HTTP Client

CVE Reports — Fri, 10 Jul 2026 02:40:57 +0000

CVE-2026-48596: Improper Neutralization of CRLF Sequences in Elixir Tesla Multipart HTTP Client

Vulnerability ID: CVE-2026-48596
CVSS Score: 2.1
Published: 2026-07-10

CVE-2026-48596 is an Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting, CWE-113) in the Elixir Tesla HTTP client. The flaw resides in how multipart content-type parameters are joined and serialized, enabling attackers to inject arbitrary headers or split HTTP requests when applications pass untrusted inputs to the parameters of multipart uploads.

TL;DR

An HTTP request/response splitting vulnerability in elixir-tesla allowed unauthenticated remote attackers to inject arbitrary headers or perform HTTP request smuggling by supplying CRLF characters to the Tesla.Multipart.add_content_type_param/2 function.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-113 (Improper Neutralization of CRLF Sequences)
Attack Vector: Local/Remote via application integration pattern
CVSS v4.0 Score: 2.1 (Low)
EPSS Score: 0.0017 (Percentile: 6.66%)
Impact: HTTP Request Splitting and Header Injection
Exploit Status: poc
KEV Status: Not Listed

Affected Systems

Elixir applications utilizing the elixir-tesla HTTP client library with user-provided parameters forwarded directly to the multipart boundary or charset configuration APIs.
tesla: from 0.8.0 before 1.18.3 (Fixed in: 1.18.3)

Code Analysis

Commit: 23601ed

Strictly validate content-type parameters according to RFC 7231 §3.1.1.1, preventing carriage return, line feed, and semicolon characters from being accepted.

Mitigation Strategies

Upgrade to version 1.18.3 or higher of the tesla hex package.
Sanitize user-provided values passed to add_content_type_param/2 by explicitly stripping or rejecting carriage returns, line feeds, and semicolons.
Implement static analysis checks to detect unvalidated parameters passing from entry-points into Tesla Multipart constructs.

Remediation Steps:

Open your application's mix.exs configuration file.
Locate the tesla dependency declaration in the deps/0 list.
Update the version constraint to {:tesla, "~> 1.18.3"}.
Run mix deps.update tesla to download and lock the secured package version.
Run mix test to confirm that standard multipart behavior remains functional.

References

Read the full report for CVE-2026-48596 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-48594: CVE-2026-48594: Decompression Bomb Denial of Service in Elixir Tesla HTTP Client

CVE Reports — Fri, 10 Jul 2026 02:11:04 +0000

CVE-2026-48594: Decompression Bomb Denial of Service in Elixir Tesla HTTP Client

Vulnerability ID: CVE-2026-48594
CVSS Score: 8.2
Published: 2026-07-10

An improper handling of highly compressed data (decompression bomb) vulnerability exists in the Elixir Tesla HTTP client when utilizing response decompression middlewares. By serving highly compressed responses or stacked content-encoding headers, a malicious server can cause arbitrary heap exhaustion, leading to a denial of service (DoS) crash in the BEAM virtual machine.

TL;DR

Unrestricted decompression and recursive codec handling in Tesla's decompression middleware allow remote servers to trigger heap exhaustion and BEAM VM crashes via tiny, highly compressed response payloads.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-409
Attack Vector: Network
CVSS Score: 8.2 (High)
EPSS Score: 0.00329 (Percentile: 24.87%)
Impact: Denial of Service (OOM Crash)
Exploit Status: Theoretical / Patch Analysis
KEV Status: Not Listed

Affected Systems

Elixir Applications deploying Tesla client pipelines with DecompressResponse or Compression middleware active.
tesla: >= 0.6.0, < 1.18.3 (Fixed in: 1.18.3)

Code Analysis

Commit: 340f75b

Fix decompression vulnerability in Compression middleware by adding size limit check and restricting recursive decompression.

@@ -12,4 +12,14 @@
+    if count_known_codecs(codecs) > 1 do
+      raise Error, reason: :multiple_codecs
+    end
...
+  defp start_inflate(z, body, max_body_size) do
+    case :zlib.safeInflate(z, body) do

Mitigation Strategies

Upgrade Tesla dependency to 1.18.3 or higher.
Enforce mandatory :max_body_size limits in middleware options.
Avoid handling decompression of external data with unconstrained endpoints.
Deploy network-level HTTP header filtering to drop stacked Content-Encodings.

Remediation Steps:

Open your project mix.exs file and locate the :tesla dependency.
Update the version constraint to {:tesla, "~> 1.18.3"} or higher.
Run mix deps.get to download and lock the updated version.
Locate modules utilizing Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression.
Append max_body_size: configuration parameter.
Re-compile and run test suites to ensure integration compatibility.

References

Read the full report for CVE-2026-48594 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-48595: CVE-2026-48595: Cross-Origin Credential Leakage in Elixir Tesla Client via Case-Sensitive Redirect Filter Bypass

CVE Reports — Fri, 10 Jul 2026 01:40:58 +0000

CVE-2026-48595: Cross-Origin Credential Leakage in Elixir Tesla Client via Case-Sensitive Redirect Filter Bypass

Vulnerability ID: CVE-2026-48595
CVSS Score: 8.2
Published: 2026-07-10

A high-severity security vulnerability in Elixir's Tesla HTTP client library (CVE-2026-48595) allows unauthenticated remote attackers to harvest sensitive credentials, including Authorization headers and cookies. The flaw resides in the 'Tesla.Middleware.FollowRedirects' component, which performs case-sensitive lookups when stripping credentials during cross-origin redirects. Because HTTP headers are case-insensitive by RFC specifications, standard canonical casing (e.g., 'Authorization') bypasses the lowercase-only blocklist, leaking tokens to untrusted external redirect destinations.

TL;DR

Case-sensitive header filtering in Tesla's FollowRedirects middleware fails to strip credentials like 'Authorization' during cross-origin redirects if they contain uppercase characters, leading to token leakage to untrusted hosts.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-178
Attack Vector: Network (Remote)
CVSS v4 Score: 8.2 (High)
EPSS Score: 0.00396 (0.40%)
Exploit Status: Proof of Concept (PoC) Publicly Available
CISA KEV Status: Not Listed

Affected Systems

Elixir systems integrating the elixir-tesla/tesla library with active follow-redirect modules.
tesla: >= 1.4.0, < 1.18.3 (Fixed in: 1.18.3)

Code Analysis

Commit: db963db

Hardens header filtering on redirect by introducing proper case normalization and aligning with RFC 9110 expectations.

Exploit Details

GitHub: Proof of Concept validation environment for reproducing the case-sensitivity bypass in elixir-tesla.

Mitigation Strategies

Upgrade the elixir-tesla/tesla dependency to version 1.18.3 or greater.
Normalize all outgoing HTTP header keys to lowercase at the application layer prior to dispatching requests.
Sanitize client-provided redirection inputs to avoid cross-origin redirection routes.

Remediation Steps:

Open your project's mix.exs configuration file.
Locate the {:tesla, ...} dependency definition.
Modify the version constraint to requiring '~> 1.18.3' or greater.
Execute 'mix deps.get' in your shell to fetch the updated packages.
Rebuild and run tests to ensure no regression occurs.

References

Read the full report for CVE-2026-48595 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-48597: CVE-2026-48597: Denial of Service via Atom Table Exhaustion in Elixir Tesla Client (Mint Adapter)

CVE Reports — Fri, 10 Jul 2026 01:10:59 +0000

CVE-2026-48597: Denial of Service via Atom Table Exhaustion in Elixir Tesla Client (Mint Adapter)

Vulnerability ID: CVE-2026-48597
CVSS Score: 8.2
Published: 2026-07-10

CVE-2026-48597 is a high-severity Denial of Service (DoS) vulnerability in the Elixir HTTP client library Tesla (specifically involving the Mint adapter) that allows an unauthenticated remote attacker to cause an unrecoverable crash of the Erlang Virtual Machine (BEAM). The flaw arises from the dynamic conversion of untrusted URL schemes into Erlang atoms without validation, leading to global atom table exhaustion.

TL;DR

A high-severity Denial of Service vulnerability in the Elixir Tesla HTTP client (using the Mint adapter) allows remote, unauthenticated attackers to crash the Erlang VM by submitting arbitrary URL schemes that exhaust the non-garbage-collected atom table.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-770
Attack Vector: Network
CVSS v4.0 Score: 8.2 (High)
EPSS Score: 0.00301 (0.30%)
Exploit Status: Proof of Concept (poc)
CISA KEV Status: Not Listed

Affected Systems

elixir-tesla (tesla Hex package)
tesla: >= 1.3.0, < 1.18.3 (Fixed in: 1.18.3)

Code Analysis

Commit: 4699c3c

Fix atom leak in Mint adapter by verifying scheme

Exploit Details

GitHub: Unit test suite demonstrating dynamic scheme validation bypass and subsequent atom creation prevention.

Mitigation Strategies

Upgrade the tesla library to version 1.18.3 or later to enforce scheme allow-listing.
Validate and sanitize user-supplied URLs before passing them to the Tesla client to ensure they only contain approved scheme strings like 'http' or 'https'.
Disable the automatic following of redirects when interacting with untrusted hosts, or intercept redirect URLs to filter out unexpected schemes.
Switch to an alternative HTTP adapter (such as Hackney or Finch) that does not convert dynamic request metadata into atoms.

Remediation Steps:

Open your Elixir project's mix.exs file.
Locate the {:tesla, ...} dependency definition.
Update the version constraint to '~> 1.18.3' or higher.
Run 'mix deps.update tesla' in your terminal to fetch and compile the patched version.
Deploy the updated application to production and monitor the VM's atom table count to verify stability.

References

Read the full report for CVE-2026-48597 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-48598: CVE-2026-48598: Multipart Part Header Injection and Request Smuggling in elixir-tesla

CVE Reports — Fri, 10 Jul 2026 00:41:02 +0000

CVE-2026-48598: Multipart Part Header Injection and Request Smuggling in elixir-tesla

Vulnerability ID: CVE-2026-48598
CVSS Score: 2.1
Published: 2026-07-10

An Improper Encoding or Escaping of Output vulnerability (CWE-116) in elixir-tesla allowed unauthenticated remote code execution or request smuggling via unescaped Content-Disposition parameters in multipart form-data requests.

TL;DR

Unescaped carriage returns, line feeds, and double-quotes in elixir-tesla's multipart module allow multipart header injection and request smuggling.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-116
Attack Vector: Local
CVSS v4.0 Score: 2.1 (Low)
EPSS Score: 0.00143
Impact: Low Subsequent System Integrity
Exploit Status: Proof of Concept
KEV Status: Not Listed

Affected Systems

elixir-tesla
tesla: >= 0.8.0, < 1.18.3 (Fixed in: 1.18.3)

Code Analysis

Commit: bb1a2c3

Remediation patch introducing assert_disposition_value! function

--- a/lib/tesla/multipart.ex\n+++ b/lib/tesla/multipart.ex

Commit: 23601ed

Strict RFC 7230 token whitelisting using binary pattern matches

--- a/lib/tesla/multipart.ex\n+++ b/lib/tesla/multipart.ex

Exploit Details

GitHub Security Advisory: Detailed discussion and description of the vulnerability.

Mitigation Strategies

Upgrade the elixir-tesla dependency to version 1.18.3 or newer
Filter user-controlled input values to remove carriage returns, line feeds, and double-quote characters before parsing
Wrap dynamic multipart compilation steps in exception-handling blocks to prevent application crashes

Remediation Steps:

Open your mix.exs configuration file
Locate the {:tesla, "..."} dependency line and update the version requirement to >= 1.18.3
Execute mix deps.get to fetch the patched version of the package
Run your test suite to verify no uncaught ArgumentError exceptions occur during multipart serialization

References

Read the full report for CVE-2026-48598 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-49851: CVE-2026-49851: Algorithmic Complexity Denial of Service in Mistune Markdown Parser

CVE Reports — Fri, 10 Jul 2026 00:10:58 +0000

CVE-2026-49851: Algorithmic Complexity Denial of Service in Mistune Markdown Parser

Vulnerability ID: CVE-2026-49851
CVSS Score: 7.5
Published: 2026-07-09

CVE-2026-49851 is a high-severity algorithmic complexity vulnerability in the Mistune Markdown parser. Under specific conditions involving dense, unmatched nesting of opening square brackets, the parser fallback loops degrade from linear execution time to a worst-case quadratic complexity. This allows unauthenticated remote attackers to trigger complete CPU exhaustion and subsequent Denial of Service with a highly compact payload.

TL;DR

An algorithmic complexity degradation in the Mistune Markdown parser allows unauthenticated remote attackers to exhaust CPU resources and cause a persistent denial of service via malformed nested bracket sequences.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-407
Attack Vector: Network
CVSS v3.1 Score: 7.5 (High)
CVSS v4.0 Score: 8.7 (High)
Impact: Denial of Service / CPU Exhaustion
Exploit Status: PoC available
KEV Status: Not listed

Affected Systems

Mistune Markdown Parser (PyPI Package)
mistune: < 3.3.0 (Fixed in: 3.3.0)

Code Analysis

Commit: d68b0d0

First optimization sweep aiming to skip scanned bracket positions on parsing failure.

Commit: b6b499d

Implemented high-water mark optimization tracking no_close_bracket_before limits.

Commit: 5de41fb

Complete architecture rewrite implementing the linear bracket map cache.

Exploit Details

GitHub Security Advisories: Advisory referencing structural algorithmic complexities within the inline parsing engines.

Mitigation Strategies

Upgrade the Mistune dependency to version 3.3.0 or higher.
Deploy custom WAF rules to detect and drop payloads with consecutive open brackets.
Implement application-level input sanitization to filter or reject abnormal bracket nesting.

Remediation Steps:

Identify all python environments utilizing the mistune package.
Execute pip install --upgrade mistune>=3.3.0 in the target environment.
Deploy input inspection middleware to drop inputs containing sequence structures of 30 or more consecutive unmatched brackets.

References

Read the full report for CVE-2026-49851 on our website for more details including interactive diagrams and full exploit analysis.