Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint. Tesla.Adapter.Mint.open_conn/2 conv…
中危 CVSS 5.9
摘要
Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint. Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — eit…
中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。
深度研判
该漏洞尚未生成深度研判报告（DR-003 v2 AI pipeline 建设中）。
受影响产品
- :
数据来源
- NVD DATABASE
原始链接
- https://cna.erlef.org/cves/CVE-2026-48597.html Third Party Advisory
- https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e Broken Link
- https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm Vendor Advisory
- https://osv.dev/vulnerability/EEF-CVE-2026-48597 Third Party Advisory
- https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm Vendor Advisory
时间线
- nvd_ingest NVD