---
id: CVE-2026-48597
title: >-
  Allocation of Resources Without Limits or Throttling vulnerability in
  elixir-tesla tesla allows denial of service via atom table exhaustion in
  Tesla.Adapter.Mint.


  Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing …
summary: >-
  Allocation of Resources Without Limits or Throttling vulnerability in
  elixir-tesla tesla allows denial of service via atom table exhaustion in
  Tesla.Adapter.Mint.


  Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing …
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
vendor: elixir-tesla
product: tesla
affected:
  - 'tesla >= 1.3.0, < 1.18.3'
patched:
  - tesla 1.18.3
published: '2026-06-02'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:17:13.573'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48597'
references:
  - url: 'https://cna.erlef.org/cves/CVE-2026-48597.html'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/elixir-tesla/tesla/commit/ccd0823d4ba37581a37d8f6108f9a81b263237ef
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-48597'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48597'
  - url: 'https://github.com/advisories/GHSA-h74c-q9j7-mpcm'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - erlang
  - score-dispute
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-03T14:44:24.414813Z'
scores:
  nvd: 5.9
  cna: 8.2
epss: 0.00631
epssPercentile: 0.48165
aliases:
  - GHSA-h74c-q9j7-mpcm
ecosystem: erlang
ingestedAt: '2026-07-10T00:54:12.233Z'
---

## Overview

Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.

Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.

This issue affects tesla: from 1.3.0 before 1.18.3.

## Affected

- `tesla >= 1.3.0, < 1.18.3`

## Remediation

Upgrade past the affected range:

- `tesla 1.18.3`

## Package advisory (CVE-2026-48597)

Affected packages:

- `tesla >= 1.3.0, < 1.18.3`

Patched in:

- `tesla 1.18.3`

Source: https://github.com/advisories/GHSA-h74c-q9j7-mpcm