CVE-2026-48597 Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint
An attacker can crash the Elixir VM by exhausting the atom table through unvalidated URL schemes in Tesla.Adapter.Mint, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48597?
CVE-2026-48597 is a high-severity denial of service vulnerability in elixir-tesla tesla, published on 2 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.
Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.
This issue affects tesla: from 1.3.0 before 1.18.3.
Weakness: CWE-770
Which versions are affected by CVE-2026-48597?
3 open source packages ship an affected version, including tesla. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tesla Hex | From 1.3.0 | 1.18.3 |
tesla Hex | From 1.3.0 | 1.18.3 |
tesla Hex | From 1.3.0 | 1.18.3 |
Products include Elixir-Tesla Tesla.
How do I fix CVE-2026-48597?
Upgrade tesla to 1.18.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-48597 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48597 exists.
Other vulnerabilities in elixir-tesla tesla
- CVE-2026-48594 Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression
- CVE-2026-48595 Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects
- CVE-2026-48596 CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection
- CVE-2026-48598 CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection
Sources
Also known as EEF-CVE-2026-48597, GHSA-h74c-q9j7-mpcm.