https://vulnerability.circl.lu/sightings/feed 2026-09-15T18:24:41.995160+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/49252adb-6334-4d13-881e-c8a0a4017564/export 2026-09-15T18:24:42.024882+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "49252adb-6334-4d13-881e-c8a0a4017564", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48599", "type": "seen", "source": "https://gist.github.com/alon710/de2f443dedb4eb6745ce771bf61c5306", "content": "# CVE-2026-48599: CVE-2026-48599: Authorization Bypass in elixir-grpc/grpc Transcoding Layer\n\n> **CVSS Score:** 7.6\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48599\n\n## Summary\nAn authorization bypass vulnerability exists in the elixir-grpc/grpc library version 0.8.0 up to 1.0.0. Due to insecure map merging precedence inside the HTTP-to-gRPC transcoding engine, query-string parameters and request bodies can override routing path variables, allowing attackers to execute unauthorized actions on other accounts.\n\n## TL;DR\nAn insecure Map.merge sequence in the elixir-grpc transcoding layer allows attackers to bypass tenancy controls by overriding authoritative path parameters via HTTP parameter pollution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 7.6 (High)\n- **EPSS Score / Percentile**: 0.00273 / 19.15%\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n- **Ransomware Use**: No\n\n## Affected Systems\n\n- elixir-grpc/grpc\n- **elixir-grpc/grpc**: >= 0.8.0, < 1.0.0 (Fixed in: `1.0.0`)\n\n## Mitigation\n\n- Upgrade to elixir-grpc/grpc version 1.0.0 or higher\n- Implement validation logic inside the gRPC service handler using authentication headers\n- Configure API Gateways to strip conflicting query parameters\n\n**Remediation Steps:**\n1. Modify your mix.exs file to pin grpc to version 1.0.0 or later.\n2. Run mix deps.get and mix deps.compile to fetch the patched library.\n3. Deploy the updated application to production environments.\n\n## References\n\n- [GHSA-mwr4-5g34-j5cq: Authorization Bypass in elixir-grpc/grpc](https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq)\n- [Fix http transcode binding priorities](https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4)\n- [Erlang Ecosystem Foundation Advisory](https://cna.erlef.org/cves/CVE-2026-48599.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48599) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-26T10:31:32.228017Z"} 2026-08-26T10:31:32.228017+00:00 https://vulnerability.circl.lu/sighting/53753fc9-621f-475d-80ac-7f6d3b23ad51/export 2026-09-15T18:24:42.026806+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "53753fc9-621f-475d-80ac-7f6d3b23ad51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48599", "type": "published-proof-of-concept", "source": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq", "content": "", "creation_timestamp": "2026-08-25T20:35:28.041205Z"} 2026-08-25T20:35:28.041205+00:00 https://vulnerability.circl.lu/sighting/74992f22-4473-4b13-baaf-4af5f2077654/export 2026-09-15T18:24:42.028466+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "74992f22-4473-4b13-baaf-4af5f2077654", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48596", "type": "seen", "source": "https://gist.github.com/alon710/c858490dcced6d8c05b3d0f0cec528f1", "content": "# CVE-2026-48596: CVE-2026-48596: Improper Neutralization of CRLF Sequences in Elixir Tesla Multipart HTTP Client\n\n> **CVSS Score:** 2.1\n> **Published:** 2026-07-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48596\n\n## Summary\nCVE-2026-48596 is an Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting, CWE-113) in the Elixir Tesla HTTP client. The flaw resides in how multipart content-type parameters are joined and serialized, enabling attackers to inject arbitrary headers or split HTTP requests when applications pass untrusted inputs to the parameters of multipart uploads.\n\n## TL;DR\nAn HTTP request/response splitting vulnerability in elixir-tesla allowed unauthenticated remote attackers to inject arbitrary headers or perform HTTP request smuggling by supplying CRLF characters to the Tesla.Multipart.add_content_type_param/2 function.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-113 (Improper Neutralization of CRLF Sequences)\n- **Attack Vector**: Local/Remote via application integration pattern\n- **CVSS v4.0 Score**: 2.1 (Low)\n- **EPSS Score**: 0.0017 (Percentile: 6.66%)\n- **Impact**: HTTP Request Splitting and Header Injection\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Elixir applications utilizing the elixir-tesla HTTP client library with user-provided parameters forwarded directly to the multipart boundary or charset configuration APIs.\n- **tesla**: from 0.8.0 before 1.18.3 (Fixed in: `1.18.3`)\n\n## Mitigation\n\n- Upgrade to version 1.18.3 or higher of the tesla hex package.\n- Sanitize user-provided values passed to add_content_type_param/2 by explicitly stripping or rejecting carriage returns, line feeds, and semicolons.\n- Implement static analysis checks to detect unvalidated parameters passing from entry-points into Tesla Multipart constructs.\n\n**Remediation Steps:**\n1. Open your application's `mix.exs` configuration file.\n2. Locate the `tesla` dependency declaration in the `deps/0` list.\n3. Update the version constraint to `{:tesla, \"~> 1.18.3\"}`.\n4. Run `mix deps.update tesla` to download and lock the secured package version.\n5. Run `mix test` to confirm that standard multipart behavior remains functional.\n\n## References\n\n- [GitHub Security Advisory GHSA-q7jx-v53g-848w](https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w)\n- [Fix Commit](https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2)\n- [Erlang Ecosystem Foundation Advisory details](https://cna.erlef.org/cves/CVE-2026-48596.html)\n- [OSV Database Record](https://osv.dev/vulnerability/EEF-CVE-2026-48596)\n- [NVD Vulnerability Record](https://nvd.nist.gov/vuln/detail/CVE-2026-48596)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-48596)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48596) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-10T02:42:38.354642Z"} 2026-07-10T02:42:38.354642+00:00 https://vulnerability.circl.lu/sighting/4293cffc-b3e3-4273-87bf-e6e70407b30b/export 2026-09-15T18:24:42.028635+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "4293cffc-b3e3-4273-87bf-e6e70407b30b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48596", "type": "published-proof-of-concept", "source": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w", "content": "", "creation_timestamp": "2026-07-10T02:35:12.655745Z"} 2026-07-10T02:35:12.655745+00:00 https://vulnerability.circl.lu/sighting/1ee962a2-bddc-47ac-aeae-e81b5a5aa976/export 2026-09-15T18:24:42.028763+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "1ee962a2-bddc-47ac-aeae-e81b5a5aa976", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48594", "type": "published-proof-of-concept", "source": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-mc85-72gr-vm9f", "content": "", "creation_timestamp": "2026-07-10T02:35:10.408608Z"} 2026-07-10T02:35:10.408608+00:00 https://vulnerability.circl.lu/sighting/b8566816-2aef-49ae-b52b-116172ae69a2/export 2026-09-15T18:24:42.028864+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "b8566816-2aef-49ae-b52b-116172ae69a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48595", "type": "published-proof-of-concept", "source": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m", "content": "", "creation_timestamp": "2026-07-10T02:35:08.163163Z"} 2026-07-10T02:35:08.163163+00:00 https://vulnerability.circl.lu/sighting/1f84357d-02eb-4ada-9281-3de1d15ceb64/export 2026-09-15T18:24:42.028960+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "1f84357d-02eb-4ada-9281-3de1d15ceb64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48597", "type": "published-proof-of-concept", "source": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm", "content": "", "creation_timestamp": "2026-07-10T02:35:05.931939Z"} 2026-07-10T02:35:05.931939+00:00 https://vulnerability.circl.lu/sighting/67d24b1a-6ce4-4822-a695-a7c1e84b091e/export 2026-09-15T18:24:42.029054+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "67d24b1a-6ce4-4822-a695-a7c1e84b091e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48598", "type": "published-proof-of-concept", "source": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4", "content": "", "creation_timestamp": "2026-07-10T02:35:03.650983Z"} 2026-07-10T02:35:03.650983+00:00 https://vulnerability.circl.lu/sighting/68072a44-577a-4dbb-a687-2d0ec520c1cf/export 2026-09-15T18:24:42.029165+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "68072a44-577a-4dbb-a687-2d0ec520c1cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48594", "type": "seen", "source": "https://gist.github.com/alon710/771904cdd1d35750b64c7a038f4ce112", "content": "# CVE-2026-48594: CVE-2026-48594: Decompression Bomb Denial of Service in Elixir Tesla HTTP Client\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-07-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48594\n\n## Summary\nAn improper handling of highly compressed data (decompression bomb) vulnerability exists in the Elixir Tesla HTTP client when utilizing response decompression middlewares. By serving highly compressed responses or stacked content-encoding headers, a malicious server can cause arbitrary heap exhaustion, leading to a denial of service (DoS) crash in the BEAM virtual machine.\n\n## TL;DR\nUnrestricted decompression and recursive codec handling in Tesla's decompression middleware allow remote servers to trigger heap exhaustion and BEAM VM crashes via tiny, highly compressed response payloads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-409\n- **Attack Vector**: Network\n- **CVSS Score**: 8.2 (High)\n- **EPSS Score**: 0.00329 (Percentile: 24.87%)\n- **Impact**: Denial of Service (OOM Crash)\n- **Exploit Status**: Theoretical / Patch Analysis\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Elixir Applications deploying Tesla client pipelines with DecompressResponse or Compression middleware active.\n- **tesla**: >= 0.6.0, < 1.18.3 (Fixed in: `1.18.3`)\n\n## Mitigation\n\n- Upgrade Tesla dependency to 1.18.3 or higher.\n- Enforce mandatory :max_body_size limits in middleware options.\n- Avoid handling decompression of external data with unconstrained endpoints.\n- Deploy network-level HTTP header filtering to drop stacked Content-Encodings.\n\n**Remediation Steps:**\n1. Open your project mix.exs file and locate the :tesla dependency.\n2. Update the version constraint to {:tesla, \"~> 1.18.3\"} or higher.\n3. Run mix deps.get to download and lock the updated version.\n4. Locate modules utilizing Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression.\n5. Append max_body_size: configuration parameter.\n6. Re-compile and run test suites to ensure integration compatibility.\n\n## References\n\n- [GitHub Advisory GHSA-mc85-72gr-vm9f](https://github.com/elixir-tesla/tesla/security/advisories/GHSA-mc85-72gr-vm9f)\n- [Official Fix Commit](https://github.com/elixir-tesla/tesla/commit/340f75b5d191dc747ef7ac6365bd002d1cd55a9d)\n- [CVE-2026-48594 Record](https://www.cve.org/CVERecord?id=CVE-2026-48594)\n- [NVD CVE-2026-48594 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-48594)\n- [EEF/CNA Advisory Portal](https://cna.erlef.org/cves/CVE-2026-48594.html)\n- [OSV Entry for EEF-CVE-2026-48594](https://osv.dev/vulnerability/EEF-CVE-2026-48594)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48594) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-10T02:12:08.091772Z"} 2026-07-10T02:12:08.091772+00:00 https://vulnerability.circl.lu/sighting/80d2327d-377f-461b-85ac-b6917b7aea7b/export 2026-09-15T18:24:42.029291+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "80d2327d-377f-461b-85ac-b6917b7aea7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48595", "type": "seen", "source": "https://gist.github.com/alon710/34fe998f34bdbbf866bd428a21589671", "content": "# CVE-2026-48595: CVE-2026-48595: Cross-Origin Credential Leakage in Elixir Tesla Client via Case-Sensitive Redirect Filter Bypass\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-07-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48595\n\n## Summary\nA high-severity security vulnerability in Elixir's Tesla HTTP client library (CVE-2026-48595) allows unauthenticated remote attackers to harvest sensitive credentials, including Authorization headers and cookies. The flaw resides in the 'Tesla.Middleware.FollowRedirects' component, which performs case-sensitive lookups when stripping credentials during cross-origin redirects. Because HTTP headers are case-insensitive by RFC specifications, standard canonical casing (e.g., 'Authorization') bypasses the lowercase-only blocklist, leaking tokens to untrusted external redirect destinations.\n\n## TL;DR\nCase-sensitive header filtering in Tesla's FollowRedirects middleware fails to strip credentials like 'Authorization' during cross-origin redirects if they contain uppercase characters, leading to token leakage to untrusted hosts.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-178\n- **Attack Vector**: Network (Remote)\n- **CVSS v4 Score**: 8.2 (High)\n- **EPSS Score**: 0.00396 (0.40%)\n- **Exploit Status**: Proof of Concept (PoC) Publicly Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Elixir systems integrating the elixir-tesla/tesla library with active follow-redirect modules.\n- **tesla**: >= 1.4.0, < 1.18.3 (Fixed in: `1.18.3`)\n\n## Mitigation\n\n- Upgrade the elixir-tesla/tesla dependency to version 1.18.3 or greater.\n- Normalize all outgoing HTTP header keys to lowercase at the application layer prior to dispatching requests.\n- Sanitize client-provided redirection inputs to avoid cross-origin redirection routes.\n\n**Remediation Steps:**\n1. Open your project's mix.exs configuration file.\n2. Locate the {:tesla, ...} dependency definition.\n3. Modify the version constraint to requiring '~> 1.18.3' or greater.\n4. Execute 'mix deps.get' in your shell to fetch the updated packages.\n5. Rebuild and run tests to ensure no regression occurs.\n\n## References\n\n- [GitHub Security Advisory - GHSA-9m9w-gxf7-rh8m](https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m)\n- [CNA EEF Advisory Record](https://cna.erlef.org/cves/CVE-2026-48595.html)\n- [OSV Entry](https://osv.dev/vulnerability/EEF-CVE-2026-48595)\n- [CVE.org Record Database](https://www.cve.org/CVERecord?id=CVE-2026-48595)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48595) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-10T01:41:47.998773Z"} 2026-07-10T01:41:47.998773+00:00