Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint. Tesla.Adapter.Mint.open_conn/2 conv…
Medium CVSS 5.9
Summary
Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint. Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — eit…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://cna.erlef.org/cves/CVE-2026-48597.html Third Party Advisory
- https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e Broken Link
- https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm Vendor Advisory
- https://osv.dev/vulnerability/EEF-CVE-2026-48597 Third Party Advisory
- https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm Vendor Advisory
Timeline
- nvd_ingest NVD