Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint. Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application. This issue affects tesla: from 1.3.0 before 1.18.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| elixir-tesla | tesla | 1.3.0 to before 1.18.3 | 1.18.3 | Patch available | CNA |
| — | tesla (Hex) | 1.3.0 to before 1.18.3 | 1.18.3 | Patch available | GHSA-h74c-q9j7-mpcm |
- tesla Vendorelixir-tesla Affected 1.3.0 to before 1.18.3 Fixed in 1.18.3 Patch available CNA
- tesla (Hex) Vendor— Affected 1.3.0 to before 1.18.3 Fixed in 1.18.3 Patch available GHSA-h74c-q9j7-mpcm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:* | 1.3.0 to before 1.18.3 | Vulnerable | elixir-tesla |
- cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:* Versions 1.3.0 to before 1.18.3 Vulnerable ·elixir-tesla
Remediation
- Fix · CNA tesla (elixir-tesla) Fixed in 1.18.3
- Fix · GHSA-h74c-q9j7-mpcm tesla (Hex) Fixed in 1.18.3 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
elixir-tesla tesla 1.18.3
5 records Highest priority Priority HIGH 2 HIGH, 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-35951 Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirectsPriority HIGH 69
- TI-2026-35954 CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injectionPriority MEDIUM 44
- TI-2026-35952 CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injectionPriority MEDIUM 44
Timeline
- 2026-10-02 Threatist record created from CVE-2026-48597
- 2026-10-03 Alias added: GHSA-h74c-q9j7-mpcm
References
Advisory 4
More elixir-tesla Tesla vulnerabilities
- TI-2026-35951 Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects CVSS 4.0HIGH 8.2
- TI-2026-35954 CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection CVSS 4.0LOW 2.1
- TI-2026-35952 CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection CVSS 4.0LOW 2.1
- TI-2026-35950 Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression CVSS 4.0HIGH 8.2
Sources
- CVE-2026-48597 · CVE Program
- CVE-2026-48597 · NVD
- FIRST EPSS
- GHSA-h74c-q9j7-mpcm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences