CVE-2026-48597 Details
Description
Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint. Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application. This issue affects tesla: from 1.3.0 before 1.18.3.
A denial-of-service vulnerability has been identified in the Elixir Tesla library, specifically in versions 1.3.0 prior to 1.18.3. The issue arises in the Tesla.Adapter.Mint module, where the URL scheme of outgoing requests is converted into a BEAM atom without proper validation. This unchecked conversion allows an attacker to create permanent atoms by manipulating the scheme, leading to exhaustion of the atom table. Since BEAM atoms are not garbage-collected and the atom table has a fixed limit of approximately 1,048,576 entries, this exploitation can cause the Elixir virtual machine to crash, disrupting the entire application.
Users can upgrade to Tesla version 1.18.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm | CISA-ADP | Vendor Advisory |
| https://cna.erlef.org/cves/CVE-2026-48597.html | EEF | Third Party Advisory |
| https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e | EEF | Broken Link |
| https://github.com/elixir-tesla/tesla/commit/ccd0823d4ba37581a37d8f6108f9a81b263237ef | EEF | |
| https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm | EEF | Vendor Advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-48597 | EEF | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | EEF |
Affected Products
| Product | Versions |
|---|---|
| elixir-tesla tesla | >= 1.3.0, < 1.18.3 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | EEF |
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Aug 18, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | New CVE Received | EEF |