{"id":3799626,"name":"tesla","ecosystem":"hex","description":"HTTP client library, with support for middleware and multiple adapters.","homepage":"https://github.com/elixir-tesla/tesla/blob/master/CHANGELOG.md","licenses":"https://github.com/elixir-tesla/tesla","normalized_licenses":["Other"],"repository_url":"https://github.com/elixir-tesla/tesla","keywords_array":[],"namespace":null,"versions_count":75,"first_release_published_at":"2015-04-06T14:18:12.000Z","latest_release_published_at":"2026-06-06T16:04:46.453Z","latest_release_number":"1.20.0","last_synced_at":"2026-07-26T19:32:41.550Z","created_at":"2022-04-11T18:19:35.949Z","updated_at":"2026-07-26T21:31:19.629Z","registry_url":"https://hex.pm/packages/tesla/","install_command":"mix hex.package fetch tesla ","documentation_url":"http://hexdocs.pm/tesla/","metadata":{},"repo_metadata":{"id":28834275,"uuid":"32357916","full_name":"elixir-tesla/tesla","owner":"elixir-tesla","description":"The flexible HTTP client library for Elixir, with support for middleware and multiple adapters.","archived":false,"fork":false,"pushed_at":"2024-04-11T19:36:45.000Z","size":1369,"stargazers_count":1947,"open_issues_count":45,"forks_count":334,"subscribers_count":50,"default_branch":"master","last_synced_at":"2024-04-14T04:09:58.975Z","etag":null,"topics":["elixir","hackney","http","http-client","ibrowse","json","middleware"],"latest_commit_sha":null,"homepage":"","language":"Elixir","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/elixir-tesla.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2015-03-16T22:55:37.000Z","updated_at":"2024-06-19T22:40:17.148Z","dependencies_parsed_at":"2023-01-14T09:41:46.503Z","dependency_job_id":"9b43013c-f701-4f2d-9618-4062128eb73e","html_url":"https://github.com/elixir-tesla/tesla","commit_stats":{"total_commits":875,"total_committers":145,"mean_commits":"6.0344827586206895","dds":0.5577142857142857,"last_synced_commit":"04a94e6a8ea04740833f0980336ea5e5d138cc0f"},"previous_names":["teamon/tesla"],"tags_count":52,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/elixir-tesla","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":217647494,"owners_count":16209853,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"elixir-tesla","name":"elixir-tesla","uuid":"105145357","kind":"organization","description":"The flexible HTTP client library for Elixir, with support for middleware and multiple adapters.","email":null,"website":null,"location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/105145357?v=4","repositories_count":2,"last_synced_at":"2023-02-28T19:40:25.714Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/elixir-tesla","funding_links":[],"total_stars":null,"followers":null,"following":null,"created_at":"2022-11-11T21:06:29.623Z","updated_at":"2023-02-28T19:40:25.790Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/elixir-tesla","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/elixir-tesla/repositories"},"tags":[{"name":"v1.10.3","sha":"ec423d75e753751e955e9912e75fed04f311a4f9","kind":"commit","published_at":"2024-06-19T21:56:49.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.10.3","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.10.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.10.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.10.3/manifests"},{"name":"v1.10.2","sha":"27cc13ee95f6dbd522b37ae6317dcfeefdb2c12f","kind":"commit","published_at":"2024-06-19T21:02:08.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.10.2","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.10.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.10.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.10.2/manifests"},{"name":"v1.10.1","sha":"92642fd46b1f33790fe47ecce7549e3181848eda","kind":"commit","published_at":"2024-06-19T19:33:45.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.10.1","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.10.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.10.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.10.1/manifests"},{"name":"v1.10.0","sha":"f1c9a36f1bd3f3712dc6d788586dcddabfcd8d40","kind":"commit","published_at":"2024-06-17T22:44:26.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.10.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.10.0/manifests"},{"name":"v1.9.0","sha":"876af0c08223febac9f5db869c6baa951de0b9d9","kind":"commit","published_at":"2024-04-11T19:36:03.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.9.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.9.0/manifests"},{"name":"v1.8.1","sha":"ddbd8c26102b29e5ce36026772ccc2322d09a119","kind":"commit","published_at":"2024-04-11T15:05:55.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.8.1","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.8.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.8.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.8.1/manifests"},{"name":"v1.8.0","sha":"d3ea190250f2807077dcc32d0d6ff85ea27b671a","kind":"commit","published_at":"2023-10-25T19:55:47.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.8.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.8.0/manifests"},{"name":"v1.7.0","sha":"55f342be9316ad75b42364b13e4398dc15b2bc26","kind":"commit","published_at":"2023-05-15T16:21:46.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.7.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.7.0/manifests"},{"name":"v1.6.1","sha":"30c3a298bc0de841d8929055429598342ef75573","kind":"commit","published_at":"2023-05-06T22:49:23.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.6.1","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.6.1/manifests"},{"name":"v1.6.0","sha":"04a94e6a8ea04740833f0980336ea5e5d138cc0f","kind":"commit","published_at":"2023-04-02T18:59:30.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.6.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.6.0/manifests"},{"name":"v1.5.1","sha":"c8970901abe13404f3966e8b6a172f178561bd90","kind":"commit","published_at":"2023-02-16T03:51:25.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.5.1","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.5.1/manifests"},{"name":"v1.5.0","sha":"791d0ac826a014fed39765df79f75cb0a94da06b","kind":"commit","published_at":"2022-12-14T18:11:51.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.5.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.5.0/manifests"},{"name":"v1.4.4","sha":"008b287da51620852c7564f369a90eecf92f5542","kind":"commit","published_at":"2021-12-17T15:06:29.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.4.4","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.4.4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.4.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.4.4/manifests"},{"name":"v1.4.3","sha":"d0e742e621447fb565d480eb82804b147b785604","kind":"commit","published_at":"2021-08-04T09:49:00.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.4.3","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.4.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.4.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.4.3/manifests"},{"name":"v1.4.2","sha":"124cfd72a5cd1e95a2e952a30b51dbff3bb62ff5","kind":"commit","published_at":"2021-07-06T10:06:14.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.4.2","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.4.2/manifests"},{"name":"v1.4.1","sha":"691dbf7b8bce406ebceaa0a74bfa290aeee33fa9","kind":"commit","published_at":"2021-04-06T09:12:05.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.4.1","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.4.1/manifests"},{"name":"v1.4.0","sha":"9341ac3a87791b3aee143088a2d43e78109a8aaa","kind":"commit","published_at":"2020-11-15T11:35:25.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.4.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.4.0/manifests"},{"name":"v1.3.3","sha":"83ff95c90e266cd982d856d056d08192806826f5","kind":"commit","published_at":"2020-03-25T20:57:20.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.3.3","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.3.3/manifests"},{"name":"v1.3.2","sha":"10e006fc041466356c9762c4e88dcf0b0ea7e036","kind":"commit","published_at":"2020-02-11T10:07:27.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.3.2","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.3.2/manifests"},{"name":"v.1.3.2","sha":"10e006fc041466356c9762c4e88dcf0b0ea7e036","kind":"commit","published_at":"2020-02-11T10:07:27.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v.1.3.2","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v.1.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v.1.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v.1.3.2/manifests"},{"name":"v1.3.1","sha":"130c2d560af62d61f949b5d1e0798a80548cd8a6","kind":"commit","published_at":"2020-01-05T14:06:30.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.3.1","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.3.1/manifests"},{"name":"v1.3.0","sha":"23e605e25a99290ecc227d0507297bf294ec579e","kind":"commit","published_at":"2019-09-05T16:54:47.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.3.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.3.0/manifests"},{"name":"v1.2.1","sha":"c1ee0e3417ea269124869ca1ff33fd2364391154","kind":"commit","published_at":"2018-11-19T16:00:07.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.2.1","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.2.1/manifests"},{"name":"v1.2.0","sha":"10579cbb2e5d43c340132c405a00ad02aabf7675","kind":"commit","published_at":"2018-10-23T17:15:33.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.2.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.2.0/manifests"},{"name":"v1.1.0","sha":"2453183377f0307252bfc177e6c5d7e021faa4d4","kind":"commit","published_at":"2018-07-13T09:47:18.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.1.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.1.0/manifests"},{"name":"v1.0.0","sha":"ea199daa52b251bfcb51a17ecb7fe1f78bdbbd02","kind":"commit","published_at":"2018-06-07T09:24:43.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.0.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.0.0/manifests"},{"name":"v1.0.0-beta.1","sha":"4ad0fb34efcdcfc06b0291533bdfed1a9b920e12","kind":"commit","published_at":"2018-03-30T10:57:51.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v1.0.0-beta.1","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v1.0.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.0.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v1.0.0-beta.1/manifests"},{"name":"v0.10.0","sha":"23a6f46854d75769fb75f9a7ba846d5fde8ccf79","kind":"commit","published_at":"2017-12-22T15:26:29.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.10.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.10.0/manifests"},{"name":"v0.9.0","sha":"fbf55b7276ae33099bd1246a0b639b9d2eb35835","kind":"commit","published_at":"2017-10-06T21:43:48.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.9.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.9.0/manifests"},{"name":"v0.8.0","sha":"fed422b5ec981cc6237b6a2c1be52e4564461bad","kind":"commit","published_at":"2017-09-11T16:12:39.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.8.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.8.0/manifests"},{"name":"v0.7.2","sha":"3f7a78960253afee62930a3ff6a7004d8b3dd8e8","kind":"commit","published_at":"2017-08-30T06:43:28.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.7.2","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.7.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.7.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.7.2/manifests"},{"name":"v0.7.1","sha":"640fd5e860491992c4aeba9ba125be711942a237","kind":"commit","published_at":"2017-05-29T10:04:05.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.7.1","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.7.1/manifests"},{"name":"v0.7.0","sha":"b80f8eaf293627f768afc369b795fe342a7e91d5","kind":"commit","published_at":"2017-04-05T08:42:44.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.7.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.7.0/manifests"},{"name":"v0.6.0","sha":"bd3ff7028470c88ec87cf1ea23d6128695809c0c","kind":"commit","published_at":"2017-01-30T13:57:57.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.6.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.6.0/manifests"},{"name":"v0.5.2","sha":"df4014426c77b0b2f17fca3457eeb6879836088f","kind":"commit","published_at":"2016-09-12T13:03:48.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.5.2","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.5.2/manifests"},{"name":"v0.5.1","sha":"dde0bb8c3034d93f2d83a4240faffbf0b66576ac","kind":"commit","published_at":"2016-08-29T15:30:09.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.5.1","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.5.1/manifests"},{"name":"v0.5.0","sha":"7add69430e75d36dd7982c0bd3be77bc90a09823","kind":"commit","published_at":"2016-08-28T19:33:52.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.5.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.5.0/manifests"},{"name":"v0.3.5","sha":"ea7450a431e2eca74ec35dcd497db48c3e0b7907","kind":"commit","published_at":"2016-08-23T20:02:25.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.3.5","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.3.5","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.3.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.3.5/manifests"},{"name":"v0.3.4","sha":"054cabdb59b2fe58999876217a184bc7c6e09b19","kind":"commit","published_at":"2016-08-23T14:19:26.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.3.4","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.3.4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.3.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.3.4/manifests"},{"name":"v0.3.3","sha":"14f8550bacd24f9e93c8f245c0ca26a9d7d68e4d","kind":"tag","published_at":"2016-08-23T10:43:09.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.3.3","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.3.3/manifests"},{"name":"v0.3.2","sha":"c18cb64e0ba12f0744a64ce8600e70bf75673e73","kind":"tag","published_at":"2016-08-23T10:36:14.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.3.2","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.3.2/manifests"},{"name":"v0.3.1","sha":"f57a8a4c2aa2fa1c94c064d198ca59f97e193e8f","kind":"commit","published_at":"2016-08-22T18:03:33.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.3.1","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.3.1/manifests"},{"name":"v0.3.0","sha":"3777a19b4b90a5cb639d904828c1e1c4ef11ca41","kind":"commit","published_at":"2016-08-22T17:58:19.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.3.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.3.0/manifests"},{"name":"v0.2.2","sha":"0bea8c8ccaf33d0adb4a0508f2f5fb46b9a8ccb7","kind":"tag","published_at":"2016-08-08T17:53:26.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.2.2","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.2.2/manifests"},{"name":"v0.2.1","sha":"a88e038773f31741fd600a4f05e9ebf8e4652f2d","kind":"commit","published_at":"2016-01-26T14:44:12.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.2.1","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.2.1/manifests"},{"name":"v0.2.0","sha":"b0217369131a3f74063d9f981589226b17e9df6f","kind":"commit","published_at":"2016-01-26T14:16:04.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.2.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.2.0/manifests"},{"name":"v0.1.5","sha":"f93b28c423a6df20b1b27c0c810a3f7a1a717d37","kind":"commit","published_at":"2015-05-16T10:31:07.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.1.5","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.1.5","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.1.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.1.5/manifests"},{"name":"v0.1.4","sha":"cf04cbb2aff3b9a9f96d70eac611d094f6c617b4","kind":"commit","published_at":"2015-04-26T14:22:31.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.1.4","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.1.4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.1.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.1.4/manifests"},{"name":"v0.1.3","sha":"56c7a4f446ce7a1190a0e09dc44c395b8b7a26cd","kind":"commit","published_at":"2015-04-26T14:20:58.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.1.3","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.1.3/manifests"},{"name":"v0.1.2","sha":"34c8ad538a412a42070b8c29a3bbfd282b7552b3","kind":"commit","published_at":"2015-04-17T16:47:03.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.1.2","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.1.2/manifests"},{"name":"v0.1.1","sha":"c23a01ada51ac00f9127dbfa45946ff36557fd7c","kind":"commit","published_at":"2015-04-06T14:43:00.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.1.1","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.1.1/manifests"},{"name":"v0.1.0","sha":"973fc732ae48c145dcf08a13ee2ff7cdff990784","kind":"commit","published_at":"2015-04-06T14:17:50.000Z","download_url":"https://codeload.github.com/elixir-tesla/tesla/tar.gz/v0.1.0","html_url":"https://github.com/elixir-tesla/tesla/releases/tag/v0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/tags/v0.1.0/manifests"}]},"repo_metadata_updated_at":"2024-09-08T12:25:39.946Z","dependent_packages_count":574,"downloads":72868165,"downloads_period":"total","dependent_repos_count":1212,"rankings":{"downloads":0.4817265078039694,"dependent_repos_count":0.430342346971546,"dependent_packages_count":0.03211510052026463,"stargazers_count":0.30830496499454046,"forks_count":0.23765174384995824,"docker_downloads_count":0.5844948294688163,"average":0.3457725822681825},"purl":"pkg:hex/tesla","advisories":[{"uuid":"GSA_kwCzR0hTQS0yOGpoLWczMngtdjl2NM4ABac5","url":"https://github.com/advisories/GHSA-28jh-g32x-v9v4","title":"Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values","description":"### Summary\n\n`Tesla.Multipart.part_headers_for_disposition/1` interpolates `Content-Disposition` parameter values (field name, filename, and other opts) verbatim into the part header line without encoding or escaping any special characters. An attacker who controls a filename, field name, or other disposition parameter can use unescaped double-quotes to inject extra disposition key-value pairs, or CRLF sequences to inject additional part headers or prepend bytes to the part body.\n\n### Details\n\n`part_headers_for_disposition/1` in `lib/tesla/multipart.ex` formats each disposition parameter as `k=\"v\"` with no sanitization. Values flow in from `add_field/4` (the `name` argument), `add_file/3` and `add_file_content/4` (the `filename` argument and any disposition opts). A `\"` in the value closes the quoted parameter early, allowing extra `; key=\"value\"` pairs to be appended. A `\\r\\n` ends the `Content-Disposition` header line entirely, with subsequent bytes interpreted as additional part headers (e.g. a forged `Content-Type`); a second `\\r\\n` ends the whole part header block and prepends attacker bytes to the part body.\n\nThe default-filename path in `add_file/3` derives the name via `Path.basename/1`, which does not strip CR or LF, so any code that forwards a partially attacker-controlled file path is equally vulnerable.\n\n### PoC\n\n1. Call `Tesla.Multipart.add_file_content/4` with a filename containing `\\r\\nX-Injected: evil`.\n2. POST the multipart body to any upstream via any Tesla adapter.\n3. The upstream receives `X-Injected: evil` as a standalone header line on the affected part.\n\n### Impact\n\nLow severity (CVSS v4.0: 2.1). Any application using `tesla` 0.8.0 through 1.18.2 that passes untrusted input into `add_field/4`, `add_file/3`, or `add_file_content/4` disposition parameters is affected. Consequences range from forging part-level headers to body prepending against lenient multipart parsers. Fixed in tesla 1.18.3.\n\n### Workarounds\n\nValidate disposition parameter values before passing them to the multipart API, rejecting any value that contains `\\r`, `\\n`, or `\"`.\n\n### Resources\n\n* Introduction commit: https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351\n* Patch commit: https://github.com/elixir-tesla/tesla/commit/bb1a2c3da2775924d96e3db8e315dcc4d5d2246e","origin":"UNSPECIFIED","severity":"LOW","published_at":"2026-07-10T00:04:37.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":2.1,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","references":["https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4","https://nvd.nist.gov/vuln/detail/CVE-2026-48598","https://github.com/elixir-tesla/tesla/commit/bb1a2c3da2775924d96e3db8e315dcc4d5d2246e","https://cna.erlef.org/cves/CVE-2026-48598.html","https://osv.dev/vulnerability/EEF-CVE-2026-48598","https://github.com/advisories/GHSA-28jh-g32x-v9v4"],"source_kind":"github","identifiers":["GHSA-28jh-g32x-v9v4","CVE-2026-48598"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-10T01:00:09.379Z","updated_at":"2026-07-26T14:00:37.604Z","epss_percentage":0.0019,"epss_percentile":0.08837,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yOGpoLWczMngtdjl2NM4ABac5","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yOGpoLWczMngtdjl2NM4ABac5","packages":[{"ecosystem":"hex","package_name":"tesla","versions":[{"first_patched_version":"1.18.3","vulnerable_version_range":"\u003e= 0.8.0, \u003c 1.18.3"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yOGpoLWczMngtdjl2NM4ABac5/related_packages","related_advisories":[{"uuid":"EEF-CVE-2026-48598","source_kind":"erlef","url":"https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4"}]},{"uuid":"GSA_kwCzR0hTQS1oNzRjLXE5ajctbXBjbc4ABac4","url":"https://github.com/advisories/GHSA-h74c-q9j7-mpcm","title":"Tesla vulnerable to atom exhaustion via untrusted URL scheme","description":"### Summary\n\nIn the Mint adapter for the Tesla HTTP client library, `Tesla.Adapter.Mint.open_conn/2` passes the URL scheme of every outgoing request through `String.to_atom/1` with no allow-list validation. Because BEAM atoms are permanent (never garbage-collected) and the atom table is bounded at roughly 1,048,576 entries, an attacker who can vary the URL scheme across requests can mint one fresh atom per request and eventually exhaust the table, crashing the VM.\n\n### Details\n\n**Vulnerable call** (`lib/tesla/adapter/mint.ex`, `open_conn/2`): the scheme field parsed from the request URI is passed directly to `String.to_atom/1` before being forwarded to `Mint.HTTP.connect/4`. Even though `Mint` raises for unrecognised schemes, the atom is already interned by that point. The function's HTTPS-branch guard confirms that no scheme normalisation occurs beforehand.\n\nThe attack surface has two entry points. First, any application-level URL-forwarding feature (webhook relay, link preview, SSRF-style proxy) where untrusted input reaches `Tesla.get/2` or equivalent. Second, any pipeline that includes `Tesla.Middleware.FollowRedirects`: a server under the attacker's control can return a `Location` header with a novel scheme, triggering the atom creation on the redirect follow.\n\n### PoC\n\n1. Stand up any application that accepts a user-supplied URL and forwards it through `Tesla.Adapter.Mint`.\n2. Send requests to the application, each with a distinct, previously unseen URL scheme (e.g. `atk1://`, `atk2://`, ...).\n3. Each request interns one new permanent atom; `Mint` rejects the connection but the atom persists.\n4. After approximately 1,000,000 requests the BEAM atom table is exhausted and the VM crashes.\n\n### Impact\n\nHigh severity (CVSS v4.0: 8.2). Any application using `tesla` 1.3.0 through 1.18.2 with `Tesla.Adapter.Mint` that allows untrusted input to influence request URLs is vulnerable to remote denial of service. No authentication or special privileges are required beyond access to the application's HTTP endpoint. Fixed in tesla 1.18.3.\n\n### Configurations\n\nThe application must use `Tesla.Adapter.Mint` and either expose a feature that forwards attacker-controlled URLs to Tesla, or include `Tesla.Middleware.FollowRedirects` in the middleware pipeline.\n\n### References\n\n* Introduction commit: https://github.com/elixir-tesla/tesla/commit/ccd0823d4ba37581a37d8f6108f9a81b263237ef\n* Patch commit: https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-07-10T00:03:51.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm","https://nvd.nist.gov/vuln/detail/CVE-2026-48597","https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e","https://cna.erlef.org/cves/CVE-2026-48597.html","https://osv.dev/vulnerability/EEF-CVE-2026-48597","https://github.com/advisories/GHSA-h74c-q9j7-mpcm"],"source_kind":"github","identifiers":["GHSA-h74c-q9j7-mpcm","CVE-2026-48597"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-10T01:00:09.379Z","updated_at":"2026-07-10T07:00:09.003Z","epss_percentage":0.00301,"epss_percentile":0.21579,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oNzRjLXE5ajctbXBjbc4ABac4","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1oNzRjLXE5ajctbXBjbc4ABac4","packages":[{"ecosystem":"hex","package_name":"tesla","versions":[{"first_patched_version":"1.18.3","vulnerable_version_range":"\u003e= 1.3.0, \u003c 1.18.3"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oNzRjLXE5ajctbXBjbc4ABac4/related_packages","related_advisories":[{"uuid":"EEF-CVE-2026-48597","source_kind":"erlef","url":"https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"}]},{"uuid":"GSA_kwCzR0hTQS05bTl3LWd4Zjctcmg4bc4ABac3","url":"https://github.com/advisories/GHSA-9m9w-gxf7-rh8m","title":"Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering","description":"### Summary\n\n`Tesla.Middleware.FollowRedirects` is meant to strip the `Authorization` header when following a cross-origin redirect, but performs the check with a case-sensitive comparison against the lowercase string `\"authorization\"`. Because Tesla preserves header keys exactly as supplied by the caller, any application that sets the header with its RFC 7235 canonical casing (`\"Authorization\"`) bypasses the filter entirely, leaking bearer tokens or other credentials to whatever origin the redirect points at.\n\n### Details\n\nThe filter list in `lib/tesla/middleware/follow_redirects.ex` is defined as `@filter_headers [\"authorization\", \"host\"]` and the membership check `k not in @filter_headers` compares the raw key string without case normalization. HTTP header names are case-insensitive per RFC 7230, but Tesla stores them verbatim. A header tuple `{\"Authorization\", \"Bearer …\"}` does not match `\"authorization\"`, so it passes through the filter and is forwarded to the redirect destination unchecked. The same defect applies to the `\"Host\"` entry.\n\nAn attacker who can control a `Location:` response seen by the victim client (their own endpoint, a redirect-open service, or a compromised upstream) receives the credential on the cross-origin follow. No special configuration is required beyond the victim using the standard header casing.\n\n### PoC\n\n1. Configure a Tesla client with `Tesla.Middleware.FollowRedirects` and set the `Authorization` header using canonical casing (`{\"Authorization\", \"Bearer \u003ctoken\u003e\"}`).\n2. Make a request to an endpoint that returns a `302` redirect to a different origin.\n3. Observe that the `Authorization` header with its value is present in the request delivered to the redirect destination.\n\n### Impact\n\nHigh severity (CVSS v4.0: 8.2). Any application using `tesla` 1.4.0 through 1.18.2 with `Tesla.Middleware.FollowRedirects` and a non-lowercase `Authorization` header is affected. The workaround is to use all-lowercase `\"authorization\"` as the header key until upgrading to 1.18.3.\n\n### Workarounds\n\nNormalize all header keys to lowercase before passing them to Tesla. Use `\"authorization\"` instead of `\"Authorization\"` when setting headers via `Tesla.put_header/3` or `Tesla.Middleware.Headers`.\n\n### Resources\n\n* Introduction commit: https://github.com/elixir-tesla/tesla/commit/2d937d5813d7cda5cd726f41824985fb655c920f\n* Patch commit: https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-07-10T00:03:31.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m","https://nvd.nist.gov/vuln/detail/CVE-2026-48595","https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182","https://cna.erlef.org/cves/CVE-2026-48595.html","https://osv.dev/vulnerability/EEF-CVE-2026-48595","https://github.com/advisories/GHSA-9m9w-gxf7-rh8m"],"source_kind":"github","identifiers":["GHSA-9m9w-gxf7-rh8m","CVE-2026-48595"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-10T01:00:09.379Z","updated_at":"2026-07-10T07:00:09.003Z","epss_percentage":0.00396,"epss_percentile":0.3154,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05bTl3LWd4Zjctcmg4bc4ABac3","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS05bTl3LWd4Zjctcmg4bc4ABac3","packages":[{"ecosystem":"hex","package_name":"tesla","versions":[{"first_patched_version":"1.18.3","vulnerable_version_range":"\u003e= 0.6.0, \u003c 1.18.3"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05bTl3LWd4Zjctcmg4bc4ABac3/related_packages","related_advisories":[{"uuid":"EEF-CVE-2026-48595","source_kind":"erlef","url":"https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m"}]},{"uuid":"GSA_kwCzR0hTQS1tYzg1LTcyZ3Itdm05Zs4ABac2","url":"https://github.com/advisories/GHSA-mc85-72gr-vm9f","title":"Tesla has decompression bomb on response body","description":"### Summary\n\nAny Tesla client pipeline that includes `Tesla.Middleware.DecompressResponse` or `Tesla.Middleware.Compression` eagerly decompresses HTTP response bodies with no size limit. A server under attacker control (or reached via a redirect) can return a tiny gzip-encoded payload that expands into gigabytes of BEAM heap, crashing or freezing the calling process. Stacking multiple `content-encoding` tokens multiplies the amplification exponentially.\n\n### Details\n\n`decompress_body/2` in `lib/tesla/middleware/compression.ex` passes the full response body to `:zlib.gunzip/1` or `:zlib.unzip/1` with no cap on output size. The list of codec tokens comes from splitting the `content-encoding` header on commas, and `decompress_body/2` recurses once per token. A response advertising `content-encoding: gzip, gzip, gzip, gzip` triggers four recursive decompression passes. Each gzip layer can expand its input roughly 1000x, so a 284-byte wire payload with four layers inflates to approximately 1 GB at the innermost pass, all materialised as a single binary in the caller's heap.\n\n### PoC\n\n1. Serve an HTTP response with `content-encoding: gzip, gzip, gzip, gzip` where the body is a 1 GB block of zeros compressed through four successive gzip passes.\n2. Send that response to a Tesla client whose pipeline includes `Tesla.Middleware.DecompressResponse`.\n3. `decompress_body/2` recurses four times without any size check, materialising ~1 GB in the calling process's heap.\n4. Repeated or sufficiently large requests exhaust available memory and crash or freeze the node.\n\n### Impact\n\nHigh severity (CVSS v4.0: 8.2). Any application using `tesla` 0.6.0 through 1.18.2 with `Tesla.Middleware.DecompressResponse` or `Tesla.Middleware.Compression` in its pipeline is vulnerable. The attacker only needs to control a server the client contacts, including via redirects. Fixed in tesla 1.18.3.\n\n### Configurations\n\nThe application must include `Tesla.Middleware.DecompressResponse` or `Tesla.Middleware.Compression` in its Tesla middleware pipeline.\n\n### Resources\n\n* Introduction commit: https://github.com/elixir-tesla/tesla/commit/5bd90bb5cf0d15e375edc2a66fa322292940fce2\n* Patch commit: https://github.com/elixir-tesla/tesla/commit/340f75b5d191dc747ef7ac6365bd002d1cd55a9d","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-07-10T00:03:23.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/elixir-tesla/tesla/security/advisories/GHSA-mc85-72gr-vm9f","https://nvd.nist.gov/vuln/detail/CVE-2026-48594","https://github.com/elixir-tesla/tesla/commit/340f75b5d191dc747ef7ac6365bd002d1cd55a9d","https://cna.erlef.org/cves/CVE-2026-48594.html","https://osv.dev/vulnerability/EEF-CVE-2026-48594","https://github.com/advisories/GHSA-mc85-72gr-vm9f"],"source_kind":"github","identifiers":["GHSA-mc85-72gr-vm9f","CVE-2026-48594"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-10T01:00:09.379Z","updated_at":"2026-07-10T07:00:09.005Z","epss_percentage":0.00329,"epss_percentile":0.24536,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tYzg1LTcyZ3Itdm05Zs4ABac2","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tYzg1LTcyZ3Itdm05Zs4ABac2","packages":[{"ecosystem":"hex","package_name":"tesla","versions":[{"first_patched_version":"1.18.3","vulnerable_version_range":"\u003e= 0.6.0, \u003c 1.18.3"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tYzg1LTcyZ3Itdm05Zs4ABac2/related_packages","related_advisories":[{"uuid":"EEF-CVE-2026-48594","source_kind":"erlef","url":"https://github.com/elixir-tesla/tesla/security/advisories/GHSA-mc85-72gr-vm9f"}]},{"uuid":"GSA_kwCzR0hTQS1xN2p4LXY1M2ctODQ4d84ABac1","url":"https://github.com/advisories/GHSA-q7jx-v53g-848w","title":"Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`","description":"### Summary\n\n`Tesla.Multipart.add_content_type_param/2` appends caller-supplied strings to the multipart `Content-Type` header with no validation. A param value containing `\\r\\n` splits the header line, allowing an attacker who controls any content-type parameter (charset, boundary parameter, etc.) to inject arbitrary headers into the outbound HTTP request.\n\n### Details\n\n`add_content_type_param/2` in `lib/tesla/multipart.ex` stores the supplied string directly in `multipart.content_type_params` without any CR/LF check. `headers/1` then joins all params with `\"; \"` and appends the result verbatim to the `Content-Type` header value. Because HTTP headers are delimited by `\\r\\n`, a param containing that sequence breaks out of the header field and introduces new header lines before the adapter writes the request to the socket.\n\nThe precondition is that untrusted input reaches `add_content_type_param/2`, which is the normal pattern for applications that accept user-supplied charset values, file type parameters, or any other content-type extension fields.\n\n### PoC\n\n1. Call `Tesla.Multipart.add_content_type_param/2` with a value containing `\\r\\nX-Injected: pwned`.\n2. Pass the resulting `Multipart` struct as the request body via any Tesla adapter.\n3. The raw request on the wire contains `X-Injected: pwned` as a standalone header line.\n\n### Impact\n\nLow severity (CVSS v4.0: 2.1). Any application using `tesla` 0.8.0 through 1.18.2 that passes untrusted input into `Tesla.Multipart.add_content_type_param/2` is affected. Consequences range from forging arbitrary outbound request headers to potential request smuggling against the upstream server. Fixed in tesla 1.18.3.\n\n### Workarounds\n\nValidate content-type parameter strings before passing them to `Tesla.Multipart.add_content_type_param/2`, rejecting any value that contains `\\r` or `\\n`.\n\n### Reesources\n\n* Introduction commit: https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351\n* Patch commit: https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2","origin":"UNSPECIFIED","severity":"LOW","published_at":"2026-07-10T00:03:12.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":2.1,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","references":["https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w","https://nvd.nist.gov/vuln/detail/CVE-2026-48596","https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2","https://cna.erlef.org/cves/CVE-2026-48596.html","https://osv.dev/vulnerability/EEF-CVE-2026-48596","https://github.com/advisories/GHSA-q7jx-v53g-848w"],"source_kind":"github","identifiers":["GHSA-q7jx-v53g-848w","CVE-2026-48596"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-10T01:00:09.379Z","updated_at":"2026-07-26T14:00:37.605Z","epss_percentage":0.00171,"epss_percentile":0.06728,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xN2p4LXY1M2ctODQ4d84ABac1","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xN2p4LXY1M2ctODQ4d84ABac1","packages":[{"ecosystem":"hex","package_name":"tesla","versions":[{"first_patched_version":"1.18.3","vulnerable_version_range":"\u003e= 0.8.0, \u003c 1.18.3"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xN2p4LXY1M2ctODQ4d84ABac1/related_packages","related_advisories":[{"uuid":"EEF-CVE-2026-48596","source_kind":"erlef","url":"https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"}]},{"uuid":"EEF-CVE-2026-48596","url":"https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w","title":"CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection","description":"## Summary\n\nImproper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add\\_content\\_type\\_param/2.\n\nTesla.Multipart.add\\_content\\_type\\_param/2 appends caller-supplied strings to the multipart content\\_type\\_params list without validating for CR (\\\\r) or LF (\\\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\\\r\\\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add\\_content\\_type\\_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3.\n\n## Workaround\n\nValidate content-type parameter strings before passing them to Tesla.Multipart.add\\_content\\_type\\_param/2, rejecting any value that contains \\\\r or \\\\n.\n\n## Configuration\n\nThe application must pass untrusted input into Tesla.Multipart.add\\_content\\_type\\_param/2.","origin":"ERLEF","severity":"LOW","published_at":"2026-06-02T19:09:31.615Z","withdrawn_at":null,"classification":null,"cvss_score":2.1,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","references":["https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w","https://cna.erlef.org/cves/CVE-2026-48596.html","https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2","https://hex.pm/packages/tesla"],"source_kind":"erlef","identifiers":["EEF-CVE-2026-48596","GHSA-q7jx-v53g-848w","CVE-2026-48596"],"repository_url":"https://github.com/elixir-tesla/tesla","blast_radius":6.475355501643562,"created_at":"2026-06-02T19:19:28.129Z","updated_at":"2026-06-04T04:45:42.210Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/EEF-CVE-2026-48596","html_url":"https://advisories.ecosyste.ms/advisories/EEF-CVE-2026-48596","packages":[{"ecosystem":"hex","package_name":"tesla","versions":[{"first_patched_version":"1.18.3","vulnerable_version_range":"\u003e= 0.8.0, \u003c 1.18.3"}],"purl":null,"statistics":{"dependent_packages_count":574,"dependent_repos_count":1212,"downloads":72858648,"downloads_period":"total"},"affected_versions":["0.8.0","0.9.0","0.10.0","1.0.0","1.0.0-beta.1","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.5.0","1.5.1","1.6.0","1.6.1","1.7.0","1.8.0","1.8.1","1.9.0","1.10.0","1.10.1","1.10.2","1.10.3","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.13.0","1.13.1","1.13.2","1.14.0","1.14.1","1.14.2","1.14.3","1.15.0","1.15.1","1.15.2","1.15.3","1.16.0","1.17.0","1.18.0","1.18.1","1.18.2"],"unaffected_versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.2.1","0.2.2","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.5.0","0.5.1","0.5.2","0.6.0","0.7.0","0.7.1","0.7.2","1.18.3","1.20.0"]}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/EEF-CVE-2026-48596/related_packages","related_advisories":[{"uuid":"GSA_kwCzR0hTQS1xN2p4LXY1M2ctODQ4d84ABac1","source_kind":"github","url":"https://github.com/advisories/GHSA-q7jx-v53g-848w"}]},{"uuid":"EEF-CVE-2026-48594","url":"https://github.com/elixir-tesla/tesla/security/advisories/GHSA-mc85-72gr-vm9f","title":"Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression","description":"## Summary\n\nImproper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-tesla tesla allows a denial of service via decompression bomb in HTTP response bodies.\n\nWhen Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression is included in a Tesla middleware pipeline, HTTP response bodies are decompressed eagerly with no size limit. The decompress\\_body/2 function in lib/tesla/middleware/compression.ex passes the entire response body to :zlib.gunzip/1 or :zlib.unzip/1 without any cap on the output size. Additionally, compression\\_algorithms/1 splits the content-encoding header on commas and decompress\\_body/2 recurses once per token, applying a decompression pass on each iteration. A server advertising content-encoding: gzip, gzip, gzip, gzip causes four recursive decompression passes, yielding exponential amplification: each gzip layer can expand its input roughly 1000x, so a payload of a few hundred bytes on the wire inflates to gigabytes of BEAM heap, exhausting memory and crashing or freezing the calling process.\n\nThis issue affects tesla: from 0.6.0 before 1.18.3.\n\n## Configuration\n\nThe application must include Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression in its Tesla middleware pipeline.","origin":"ERLEF","severity":"HIGH","published_at":"2026-06-02T19:08:49.596Z","withdrawn_at":null,"classification":null,"cvss_score":8.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/elixir-tesla/tesla/security/advisories/GHSA-mc85-72gr-vm9f","https://cna.erlef.org/cves/CVE-2026-48594.html","https://github.com/elixir-tesla/tesla/commit/340f75b5d191dc747ef7ac6365bd002d1cd55a9d","https://hex.pm/packages/tesla"],"source_kind":"erlef","identifiers":["EEF-CVE-2026-48594","GHSA-mc85-72gr-vm9f","CVE-2026-48594"],"repository_url":"https://github.com/elixir-tesla/tesla","blast_radius":25.28472148260819,"created_at":"2026-06-02T19:19:28.007Z","updated_at":"2026-06-04T04:45:31.475Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/EEF-CVE-2026-48594","html_url":"https://advisories.ecosyste.ms/advisories/EEF-CVE-2026-48594","packages":[{"ecosystem":"hex","package_name":"tesla","versions":[{"first_patched_version":"1.18.3","vulnerable_version_range":"\u003e= 0.6.0, \u003c 1.18.3"}],"purl":null,"statistics":{"dependent_packages_count":574,"dependent_repos_count":1212,"downloads":72858648,"downloads_period":"total"},"affected_versions":["0.6.0","0.7.0","0.7.1","0.7.2","0.8.0","0.9.0","0.10.0","1.0.0","1.0.0-beta.1","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.5.0","1.5.1","1.6.0","1.6.1","1.7.0","1.8.0","1.8.1","1.9.0","1.10.0","1.10.1","1.10.2","1.10.3","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.13.0","1.13.1","1.13.2","1.14.0","1.14.1","1.14.2","1.14.3","1.15.0","1.15.1","1.15.2","1.15.3","1.16.0","1.17.0","1.18.0","1.18.1","1.18.2"],"unaffected_versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.2.1","0.2.2","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.5.0","0.5.1","0.5.2","1.18.3","1.20.0"]}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/EEF-CVE-2026-48594/related_packages","related_advisories":[{"uuid":"GSA_kwCzR0hTQS1tYzg1LTcyZ3Itdm05Zs4ABac2","source_kind":"github","url":"https://github.com/advisories/GHSA-mc85-72gr-vm9f"}]},{"uuid":"EEF-CVE-2026-48595","url":"https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m","title":"Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects","description":"## Summary\n\nImproper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.\n\nTesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (@filter\\_headers \\[\"authorization\", \"host\"\\]). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as {\"Authorization\", \"Bearer …\"} (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a Location: response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other Authorization material on the cross-origin request.\n\nThis issue affects tesla: from 1.4.0 before 1.18.3.\n\n## Workaround\n\nNormalize all header keys to lowercase before passing them to Tesla. Use \"authorization\" instead of \"Authorization\" when setting headers via Tesla.put\\_header/3 or Tesla.Middleware.Headers.\n\n## Configuration\n\nThe application must include Tesla.Middleware.FollowRedirects in its Tesla middleware pipeline.","origin":"ERLEF","severity":"HIGH","published_at":"2026-06-02T19:08:48.339Z","withdrawn_at":null,"classification":null,"cvss_score":8.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m","https://cna.erlef.org/cves/CVE-2026-48595.html","https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182","https://hex.pm/packages/tesla"],"source_kind":"erlef","identifiers":["EEF-CVE-2026-48595","GHSA-9m9w-gxf7-rh8m","CVE-2026-48595"],"repository_url":"https://github.com/elixir-tesla/tesla","blast_radius":25.28472148260819,"created_at":"2026-06-02T19:19:28.083Z","updated_at":"2026-06-04T04:45:31.067Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/EEF-CVE-2026-48595","html_url":"https://advisories.ecosyste.ms/advisories/EEF-CVE-2026-48595","packages":[{"ecosystem":"hex","package_name":"tesla","versions":[{"first_patched_version":"1.18.3","vulnerable_version_range":"\u003e= 1.4.0, \u003c 1.18.3"}],"purl":null,"statistics":{"dependent_packages_count":574,"dependent_repos_count":1212,"downloads":72858648,"downloads_period":"total"},"affected_versions":["1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.5.0","1.5.1","1.6.0","1.6.1","1.7.0","1.8.0","1.8.1","1.9.0","1.10.0","1.10.1","1.10.2","1.10.3","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.13.0","1.13.1","1.13.2","1.14.0","1.14.1","1.14.2","1.14.3","1.15.0","1.15.1","1.15.2","1.15.3","1.16.0","1.17.0","1.18.0","1.18.1","1.18.2"],"unaffected_versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.2.1","0.2.2","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.5.0","0.5.1","0.5.2","0.6.0","0.7.0","0.7.1","0.7.2","0.8.0","0.9.0","0.10.0","1.0.0","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.3.3","1.18.3","1.20.0"]}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/EEF-CVE-2026-48595/related_packages","related_advisories":[{"uuid":"GSA_kwCzR0hTQS05bTl3LWd4Zjctcmg4bc4ABac3","source_kind":"github","url":"https://github.com/advisories/GHSA-9m9w-gxf7-rh8m"}]},{"uuid":"EEF-CVE-2026-48597","url":"https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm","title":"Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint","description":"## Summary\n\nAllocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open\\_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to\\_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.\n\nThis issue affects tesla: from 1.3.0 before 1.18.3.\n\n## Configuration\n\nThe application must use Tesla.Adapter.Mint and either expose a feature that forwards attacker-controlled URLs to Tesla, or include Tesla.Middleware.FollowRedirects in the middleware pipeline.","origin":"ERLEF","severity":"HIGH","published_at":"2026-06-02T19:08:40.203Z","withdrawn_at":null,"classification":null,"cvss_score":8.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm","https://cna.erlef.org/cves/CVE-2026-48597.html","https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e","https://hex.pm/packages/tesla"],"source_kind":"erlef","identifiers":["EEF-CVE-2026-48597","GHSA-h74c-q9j7-mpcm","CVE-2026-48597"],"repository_url":"https://github.com/elixir-tesla/tesla","blast_radius":25.28472148260819,"created_at":"2026-06-02T19:19:28.172Z","updated_at":"2026-06-04T04:45:28.962Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/EEF-CVE-2026-48597","html_url":"https://advisories.ecosyste.ms/advisories/EEF-CVE-2026-48597","packages":[{"ecosystem":"hex","package_name":"tesla","versions":[{"first_patched_version":"1.18.3","vulnerable_version_range":"\u003e= 1.3.0, \u003c 1.18.3"}],"purl":null,"statistics":{"dependent_packages_count":574,"dependent_repos_count":1212,"downloads":72858648,"downloads_period":"total"},"affected_versions":["1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.5.0","1.5.1","1.6.0","1.6.1","1.7.0","1.8.0","1.8.1","1.9.0","1.10.0","1.10.1","1.10.2","1.10.3","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.13.0","1.13.1","1.13.2","1.14.0","1.14.1","1.14.2","1.14.3","1.15.0","1.15.1","1.15.2","1.15.3","1.16.0","1.17.0","1.18.0","1.18.1","1.18.2"],"unaffected_versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.2.1","0.2.2","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.5.0","0.5.1","0.5.2","0.6.0","0.7.0","0.7.1","0.7.2","0.8.0","0.9.0","0.10.0","1.0.0","1.1.0","1.2.0","1.2.1","1.18.3","1.20.0"]}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/EEF-CVE-2026-48597/related_packages","related_advisories":[{"uuid":"GSA_kwCzR0hTQS1oNzRjLXE5ajctbXBjbc4ABac4","source_kind":"github","url":"https://github.com/advisories/GHSA-h74c-q9j7-mpcm"}]},{"uuid":"EEF-CVE-2026-48598","url":"https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4","title":"CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection","description":"## Summary\n\nImproper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values.\n\nTesla.Multipart.part\\_headers\\_for\\_disposition/1 interpolates each disposition parameter as #{k}=\"#{v}\" with no validation of CR (\\\\r), LF (\\\\n), or double-quote characters. The values come verbatim from the caller via Tesla.Multipart.add\\_field/4 (the name parameter), Tesla.Multipart.add\\_file/3, and Tesla.Multipart.add\\_file\\_content/4 (both the filename parameter and other disposition opts). A \" in the value closes the quoted parameter early; a \\\\r\\\\n ends the Content-Disposition header line and starts a new part header (such as a forged Content-Type), or, after a second \\\\r\\\\n, ends the entire part header block and prepends bytes to the part body. The default-filename path in add\\_file/3 derives the filename via Path.basename/1, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3.\n\n## Workaround\n\nValidate disposition parameter values before passing them to Tesla.Multipart.add\\_field/4, Tesla.Multipart.add\\_file/3, or Tesla.Multipart.add\\_file\\_content/4, rejecting any value that contains \\\\r, \\\\n, or \".\n\n## Configuration\n\nThe application must pass untrusted input into a disposition parameter of Tesla.Multipart.add\\_field/4, Tesla.Multipart.add\\_file/3, or Tesla.Multipart.add\\_file\\_content/4.","origin":"ERLEF","severity":"LOW","published_at":"2026-06-02T19:08:19.921Z","withdrawn_at":null,"classification":null,"cvss_score":2.1,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","references":["https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4","https://cna.erlef.org/cves/CVE-2026-48598.html","https://github.com/elixir-tesla/tesla/commit/bb1a2c3da2775924d96e3db8e315dcc4d5d2246e","https://hex.pm/packages/tesla"],"source_kind":"erlef","identifiers":["EEF-CVE-2026-48598","GHSA-28jh-g32x-v9v4","CVE-2026-48598"],"repository_url":"https://github.com/elixir-tesla/tesla","blast_radius":6.475355501643562,"created_at":"2026-06-02T19:19:28.216Z","updated_at":"2026-06-04T04:45:23.895Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/EEF-CVE-2026-48598","html_url":"https://advisories.ecosyste.ms/advisories/EEF-CVE-2026-48598","packages":[{"ecosystem":"hex","package_name":"tesla","versions":[{"first_patched_version":"1.18.3","vulnerable_version_range":"\u003e= 0.8.0, \u003c 1.18.3"}],"purl":null,"statistics":{"dependent_packages_count":574,"dependent_repos_count":1212,"downloads":72858648,"downloads_period":"total"},"affected_versions":["0.8.0","0.9.0","0.10.0","1.0.0","1.0.0-beta.1","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.5.0","1.5.1","1.6.0","1.6.1","1.7.0","1.8.0","1.8.1","1.9.0","1.10.0","1.10.1","1.10.2","1.10.3","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.13.0","1.13.1","1.13.2","1.14.0","1.14.1","1.14.2","1.14.3","1.15.0","1.15.1","1.15.2","1.15.3","1.16.0","1.17.0","1.18.0","1.18.1","1.18.2"],"unaffected_versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.2.1","0.2.2","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.5.0","0.5.1","0.5.2","0.6.0","0.7.0","0.7.1","0.7.2","1.18.3","1.20.0"]}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/EEF-CVE-2026-48598/related_packages","related_advisories":[{"uuid":"GSA_kwCzR0hTQS0yOGpoLWczMngtdjl2NM4ABac5","source_kind":"github","url":"https://github.com/advisories/GHSA-28jh-g32x-v9v4"}]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/hex/tesla","docker_dependents_count":16,"docker_downloads_count":14449,"usage_url":"https://repos.ecosyste.ms/usage/hex/tesla","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/hex/tesla/dependencies","status":null,"funding_links":[],"critical":true,"issue_metadata":{"last_synced_at":"2024-09-08T12:25:39.448Z","issues_count":74,"pull_requests_count":149,"avg_time_to_close_issue":30639303.64814815,"avg_time_to_close_pull_request":5036863.235294118,"issues_closed_count":54,"pull_requests_closed_count":136,"pull_request_authors_count":59,"issue_authors_count":64,"avg_comments_per_issue":2.9864864864864864,"avg_comments_per_pull_request":1.6174496644295302,"merged_pull_requests_count":112,"bot_issues_count":0,"bot_pull_requests_count":47,"past_year_issues_count":20,"past_year_pull_requests_count":80,"past_year_avg_time_to_close_issue":2297072.7,"past_year_avg_time_to_close_pull_request":1234619.1066666667,"past_year_issues_closed_count":10,"past_year_pull_requests_closed_count":75,"past_year_pull_request_authors_count":19,"past_year_issue_authors_count":18,"past_year_avg_comments_per_issue":2.05,"past_year_avg_comments_per_pull_request":0.975,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":38,"past_year_merged_pull_requests_count":68,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/elixir-tesla%2Ftesla/issues","maintainers":[{"login":"yordis","count":19,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/yordis"},{"login":"teamon","count":8,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/teamon"},{"login":"hodak","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/hodak"}],"active_maintainers":[{"login":"yordis","count":17,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/yordis"},{"login":"teamon","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/teamon"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/hex.pm/packages/tesla/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/hex.pm/packages/tesla/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/hex.pm/packages/tesla/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/hex.pm/packages/tesla/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/hex.pm/packages/tesla/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/hex.pm/packages/tesla/codemeta","maintainers":[{"uuid":"alchemist_ubi","login":"alchemist_ubi","name":null,"email":"yordis.prieto@gmail.com","url":null,"packages_count":21,"html_url":"https://hex.pm/users/alchemist_ubi","role":null,"created_at":"2026-02-11T05:49:37.231Z","updated_at":"2026-02-11T05:49:37.231Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/hex.pm/maintainers/alchemist_ubi/packages"},{"uuid":"teamon","login":"teamon","name":null,"email":null,"url":null,"packages_count":3,"html_url":"https://hex.pm/users/teamon","role":null,"created_at":"2022-11-08T14:46:16.401Z","updated_at":"2022-11-08T14:46:16.401Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/hex.pm/maintainers/teamon/packages"}]}