https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-48598.htmlhttps://patchthecve.com/cve/CVE-2026-48598.htmlThu, 24 Sep 2026 21:17:13 +0000LOW 3.7: Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values. Tesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{k}="#{v}" with no validation of CR (\r),https://patchthecve.com/cve/CVE-2026-48597.htmlhttps://patchthecve.com/cve/CVE-2026-48597.htmlThu, 24 Sep 2026 21:17:13 +0000MEDIUM 5.9: Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint. Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no ahttps://patchthecve.com/cve/CVE-2026-48596.htmlhttps://patchthecve.com/cve/CVE-2026-48596.htmlThu, 24 Sep 2026 21:17:13 +0000LOW 3.7: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2. Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart conthttps://patchthecve.com/cve/CVE-2026-48595.htmlhttps://patchthecve.com/cve/CVE-2026-48595.htmlThu, 24 Sep 2026 21:17:13 +0000MEDIUM 5.9: Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects. Tesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowehttps://patchthecve.com/cve/CVE-2026-48594.htmlhttps://patchthecve.com/cve/CVE-2026-48594.htmlThu, 24 Sep 2026 21:17:12 +0000HIGH 7.5: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-tesla tesla allows a denial of service via decompression bomb in HTTP response bodies. When Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression is included in a Tesla middleware pipeline, HTTP r