Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion…
cve CVE-2026-48597 1 source, 1 claim · Watch
NVD writes:
Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint. Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location head… the claim
Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint. Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location head… the claim
- Severity
- MEDIUM NVD
- CVSS
- 5.9 NVD
- Fixed in
- 1.18.3 NVD
- Vendor
- elixir-tesla NVD
- Product
- tesla NVD
- CWE
- CWE-770 NVD
How far exploitation has got
- No public code known
- Proof of concept
- Proof of concept, verified
- A Metasploit module
- Exploited in the wild
- Used in ransomware campaigns
Timeline
| 2026-06-02 | first spoke of it: Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint. Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application. This issue affects tesla: from 1.3.0 before 1.18.3. | NVD |
Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint. Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application. This issue affects tesla: from 1.3.0 before 1.18.3.
What it is to other things
| affects | elixir-tesla/tesla NVD |
| made_by | elixir-tesla NVD |
In words only, so not counted until a person confirms one:
| made_by | elixir_teslaNVD says “elixir-tesla” |
| affects | elixir_tesla/teslaNVD says “elixir-tesla · tesla” |
Every value, with what each source said and its receipt
| Property | Source | Said | Means here | ||||
|---|---|---|---|---|---|---|---|
| Automatable automatable | NVD | no At least one of those steps needs a person. receipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "tesla",
"packageURL": "pkg:hex/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "1.18.3",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "elixir-tesla/tesla",
"packageURL": "pkg:github/elixir-tesla/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e",
"status": "affected",
"version": "ccd0823d4ba37581a37d8f6108f9a81b263237ef",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA8CC181-83AA-4C5F-A01D-F04EC274E2FA",
"versionEndExcluding": "1.18.3",
"versionStartIncluding": "1.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.\n\nThis issue affects tesla: from 1.3.0 before 1.18.3."
},
{
"lang": "es",
"value": "Vulnerabilidad de asignación de recursos sin límites ni estrangulamiento en elixir-tesla tesla permite la denegación de servicio mediante el agotamiento de la tabla de átomos en Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 convierte el esquema de URL de cada solicitud saliente a un átomo BEAM mediante String.to_atom(uri.scheme) sin validación de lista de permitidos. Los átomos BEAM nunca se recolectan y la tabla de átomos está limitada (aproximadamente 1.048.576 entradas por defecto). Un atacante que puede influir en la URL de una solicitud de Tesla - ya sea a través de una característica de reenvío de URL a nivel de aplicación (webhook, proxy, importador) o a través de un encabezado Location devuelto por un servidor cuando Tesla.Middleware.FollowRedirects está en la cadena de procesamiento - puede crear un nuevo átomo permanente por solicitud variando la cadena del esquema. Después de suficientes solicitudes, la tabla de átomos se llena y la VM falla, provocando la caída de toda la aplicación.\n\nEste problema afecta a tesla: desde 1.3.0 hasta antes de 1.18.3."
}
],
"id": "CVE-2026-48597",
"lastModified": "2026-09-24T21:17:13.573",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-48597",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T14:44:24.414813Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-02T20:16:38.710",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48597.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Broken Link"
],
"url": "https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/elixir-tesla/tesla/commit/ccd0823d4ba37581a37d8f6108f9a81b263237ef"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48597"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
} | — | ||||
| CVSS cvss | NVD | 5.9receipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "tesla",
"packageURL": "pkg:hex/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "1.18.3",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "elixir-tesla/tesla",
"packageURL": "pkg:github/elixir-tesla/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e",
"status": "affected",
"version": "ccd0823d4ba37581a37d8f6108f9a81b263237ef",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA8CC181-83AA-4C5F-A01D-F04EC274E2FA",
"versionEndExcluding": "1.18.3",
"versionStartIncluding": "1.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.\n\nThis issue affects tesla: from 1.3.0 before 1.18.3."
},
{
"lang": "es",
"value": "Vulnerabilidad de asignación de recursos sin límites ni estrangulamiento en elixir-tesla tesla permite la denegación de servicio mediante el agotamiento de la tabla de átomos en Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 convierte el esquema de URL de cada solicitud saliente a un átomo BEAM mediante String.to_atom(uri.scheme) sin validación de lista de permitidos. Los átomos BEAM nunca se recolectan y la tabla de átomos está limitada (aproximadamente 1.048.576 entradas por defecto). Un atacante que puede influir en la URL de una solicitud de Tesla - ya sea a través de una característica de reenvío de URL a nivel de aplicación (webhook, proxy, importador) o a través de un encabezado Location devuelto por un servidor cuando Tesla.Middleware.FollowRedirects está en la cadena de procesamiento - puede crear un nuevo átomo permanente por solicitud variando la cadena del esquema. Después de suficientes solicitudes, la tabla de átomos se llena y la VM falla, provocando la caída de toda la aplicación.\n\nEste problema afecta a tesla: desde 1.3.0 hasta antes de 1.18.3."
}
],
"id": "CVE-2026-48597",
"lastModified": "2026-09-24T21:17:13.573",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-48597",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T14:44:24.414813Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-02T20:16:38.710",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48597.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Broken Link"
],
"url": "https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/elixir-tesla/tesla/commit/ccd0823d4ba37581a37d8f6108f9a81b263237ef"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48597"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
} | — | ||||
| Cvss4 cvss4 | NVD | 8.2receipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "tesla",
"packageURL": "pkg:hex/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "1.18.3",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "elixir-tesla/tesla",
"packageURL": "pkg:github/elixir-tesla/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e",
"status": "affected",
"version": "ccd0823d4ba37581a37d8f6108f9a81b263237ef",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA8CC181-83AA-4C5F-A01D-F04EC274E2FA",
"versionEndExcluding": "1.18.3",
"versionStartIncluding": "1.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.\n\nThis issue affects tesla: from 1.3.0 before 1.18.3."
},
{
"lang": "es",
"value": "Vulnerabilidad de asignación de recursos sin límites ni estrangulamiento en elixir-tesla tesla permite la denegación de servicio mediante el agotamiento de la tabla de átomos en Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 convierte el esquema de URL de cada solicitud saliente a un átomo BEAM mediante String.to_atom(uri.scheme) sin validación de lista de permitidos. Los átomos BEAM nunca se recolectan y la tabla de átomos está limitada (aproximadamente 1.048.576 entradas por defecto). Un atacante que puede influir en la URL de una solicitud de Tesla - ya sea a través de una característica de reenvío de URL a nivel de aplicación (webhook, proxy, importador) o a través de un encabezado Location devuelto por un servidor cuando Tesla.Middleware.FollowRedirects está en la cadena de procesamiento - puede crear un nuevo átomo permanente por solicitud variando la cadena del esquema. Después de suficientes solicitudes, la tabla de átomos se llena y la VM falla, provocando la caída de toda la aplicación.\n\nEste problema afecta a tesla: desde 1.3.0 hasta antes de 1.18.3."
}
],
"id": "CVE-2026-48597",
"lastModified": "2026-09-24T21:17:13.573",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-48597",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T14:44:24.414813Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-02T20:16:38.710",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48597.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Broken Link"
],
"url": "https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/elixir-tesla/tesla/commit/ccd0823d4ba37581a37d8f6108f9a81b263237ef"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48597"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
} | — | ||||
| Cvss4 vector cvss4_vector | NVD | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xreceipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "tesla",
"packageURL": "pkg:hex/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "1.18.3",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "elixir-tesla/tesla",
"packageURL": "pkg:github/elixir-tesla/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e",
"status": "affected",
"version": "ccd0823d4ba37581a37d8f6108f9a81b263237ef",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA8CC181-83AA-4C5F-A01D-F04EC274E2FA",
"versionEndExcluding": "1.18.3",
"versionStartIncluding": "1.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.\n\nThis issue affects tesla: from 1.3.0 before 1.18.3."
},
{
"lang": "es",
"value": "Vulnerabilidad de asignación de recursos sin límites ni estrangulamiento en elixir-tesla tesla permite la denegación de servicio mediante el agotamiento de la tabla de átomos en Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 convierte el esquema de URL de cada solicitud saliente a un átomo BEAM mediante String.to_atom(uri.scheme) sin validación de lista de permitidos. Los átomos BEAM nunca se recolectan y la tabla de átomos está limitada (aproximadamente 1.048.576 entradas por defecto). Un atacante que puede influir en la URL de una solicitud de Tesla - ya sea a través de una característica de reenvío de URL a nivel de aplicación (webhook, proxy, importador) o a través de un encabezado Location devuelto por un servidor cuando Tesla.Middleware.FollowRedirects está en la cadena de procesamiento - puede crear un nuevo átomo permanente por solicitud variando la cadena del esquema. Después de suficientes solicitudes, la tabla de átomos se llena y la VM falla, provocando la caída de toda la aplicación.\n\nEste problema afecta a tesla: desde 1.3.0 hasta antes de 1.18.3."
}
],
"id": "CVE-2026-48597",
"lastModified": "2026-09-24T21:17:13.573",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-48597",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T14:44:24.414813Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-02T20:16:38.710",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48597.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Broken Link"
],
"url": "https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/elixir-tesla/tesla/commit/ccd0823d4ba37581a37d8f6108f9a81b263237ef"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48597"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
} | — | ||||
| CVSS vector cvss_vector | NVD | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hreceipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "tesla",
"packageURL": "pkg:hex/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "1.18.3",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "elixir-tesla/tesla",
"packageURL": "pkg:github/elixir-tesla/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e",
"status": "affected",
"version": "ccd0823d4ba37581a37d8f6108f9a81b263237ef",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA8CC181-83AA-4C5F-A01D-F04EC274E2FA",
"versionEndExcluding": "1.18.3",
"versionStartIncluding": "1.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.\n\nThis issue affects tesla: from 1.3.0 before 1.18.3."
},
{
"lang": "es",
"value": "Vulnerabilidad de asignación de recursos sin límites ni estrangulamiento en elixir-tesla tesla permite la denegación de servicio mediante el agotamiento de la tabla de átomos en Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 convierte el esquema de URL de cada solicitud saliente a un átomo BEAM mediante String.to_atom(uri.scheme) sin validación de lista de permitidos. Los átomos BEAM nunca se recolectan y la tabla de átomos está limitada (aproximadamente 1.048.576 entradas por defecto). Un atacante que puede influir en la URL de una solicitud de Tesla - ya sea a través de una característica de reenvío de URL a nivel de aplicación (webhook, proxy, importador) o a través de un encabezado Location devuelto por un servidor cuando Tesla.Middleware.FollowRedirects está en la cadena de procesamiento - puede crear un nuevo átomo permanente por solicitud variando la cadena del esquema. Después de suficientes solicitudes, la tabla de átomos se llena y la VM falla, provocando la caída de toda la aplicación.\n\nEste problema afecta a tesla: desde 1.3.0 hasta antes de 1.18.3."
}
],
"id": "CVE-2026-48597",
"lastModified": "2026-09-24T21:17:13.573",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-48597",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T14:44:24.414813Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-02T20:16:38.710",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48597.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Broken Link"
],
"url": "https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/elixir-tesla/tesla/commit/ccd0823d4ba37581a37d8f6108f9a81b263237ef"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48597"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
} | — | ||||
| CWE cwe | NVD | CWE-770receipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "tesla",
"packageURL": "pkg:hex/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "1.18.3",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "elixir-tesla/tesla",
"packageURL": "pkg:github/elixir-tesla/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e",
"status": "affected",
"version": "ccd0823d4ba37581a37d8f6108f9a81b263237ef",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA8CC181-83AA-4C5F-A01D-F04EC274E2FA",
"versionEndExcluding": "1.18.3",
"versionStartIncluding": "1.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.\n\nThis issue affects tesla: from 1.3.0 before 1.18.3."
},
{
"lang": "es",
"value": "Vulnerabilidad de asignación de recursos sin límites ni estrangulamiento en elixir-tesla tesla permite la denegación de servicio mediante el agotamiento de la tabla de átomos en Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 convierte el esquema de URL de cada solicitud saliente a un átomo BEAM mediante String.to_atom(uri.scheme) sin validación de lista de permitidos. Los átomos BEAM nunca se recolectan y la tabla de átomos está limitada (aproximadamente 1.048.576 entradas por defecto). Un atacante que puede influir en la URL de una solicitud de Tesla - ya sea a través de una característica de reenvío de URL a nivel de aplicación (webhook, proxy, importador) o a través de un encabezado Location devuelto por un servidor cuando Tesla.Middleware.FollowRedirects está en la cadena de procesamiento - puede crear un nuevo átomo permanente por solicitud variando la cadena del esquema. Después de suficientes solicitudes, la tabla de átomos se llena y la VM falla, provocando la caída de toda la aplicación.\n\nEste problema afecta a tesla: desde 1.3.0 hasta antes de 1.18.3."
}
],
"id": "CVE-2026-48597",
"lastModified": "2026-09-24T21:17:13.573",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-48597",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T14:44:24.414813Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-02T20:16:38.710",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48597.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Broken Link"
],
"url": "https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/elixir-tesla/tesla/commit/ccd0823d4ba37581a37d8f6108f9a81b263237ef"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48597"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
} | — | ||||
| Exploitation exploitation | NVD | poc A public proof of concept exists, or exploitation is trivial. receipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "tesla",
"packageURL": "pkg:hex/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "1.18.3",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "elixir-tesla/tesla",
"packageURL": "pkg:github/elixir-tesla/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e",
"status": "affected",
"version": "ccd0823d4ba37581a37d8f6108f9a81b263237ef",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA8CC181-83AA-4C5F-A01D-F04EC274E2FA",
"versionEndExcluding": "1.18.3",
"versionStartIncluding": "1.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.\n\nThis issue affects tesla: from 1.3.0 before 1.18.3."
},
{
"lang": "es",
"value": "Vulnerabilidad de asignación de recursos sin límites ni estrangulamiento en elixir-tesla tesla permite la denegación de servicio mediante el agotamiento de la tabla de átomos en Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 convierte el esquema de URL de cada solicitud saliente a un átomo BEAM mediante String.to_atom(uri.scheme) sin validación de lista de permitidos. Los átomos BEAM nunca se recolectan y la tabla de átomos está limitada (aproximadamente 1.048.576 entradas por defecto). Un atacante que puede influir en la URL de una solicitud de Tesla - ya sea a través de una característica de reenvío de URL a nivel de aplicación (webhook, proxy, importador) o a través de un encabezado Location devuelto por un servidor cuando Tesla.Middleware.FollowRedirects está en la cadena de procesamiento - puede crear un nuevo átomo permanente por solicitud variando la cadena del esquema. Después de suficientes solicitudes, la tabla de átomos se llena y la VM falla, provocando la caída de toda la aplicación.\n\nEste problema afecta a tesla: desde 1.3.0 hasta antes de 1.18.3."
}
],
"id": "CVE-2026-48597",
"lastModified": "2026-09-24T21:17:13.573",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-48597",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T14:44:24.414813Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-02T20:16:38.710",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48597.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Broken Link"
],
"url": "https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/elixir-tesla/tesla/commit/ccd0823d4ba37581a37d8f6108f9a81b263237ef"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48597"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
} | — | ||||
| Fixed in fixed_in | NVD | 1.18.3receipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "tesla",
"packageURL": "pkg:hex/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "1.18.3",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "elixir-tesla/tesla",
"packageURL": "pkg:github/elixir-tesla/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e",
"status": "affected",
"version": "ccd0823d4ba37581a37d8f6108f9a81b263237ef",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA8CC181-83AA-4C5F-A01D-F04EC274E2FA",
"versionEndExcluding": "1.18.3",
"versionStartIncluding": "1.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.\n\nThis issue affects tesla: from 1.3.0 before 1.18.3."
},
{
"lang": "es",
"value": "Vulnerabilidad de asignación de recursos sin límites ni estrangulamiento en elixir-tesla tesla permite la denegación de servicio mediante el agotamiento de la tabla de átomos en Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 convierte el esquema de URL de cada solicitud saliente a un átomo BEAM mediante String.to_atom(uri.scheme) sin validación de lista de permitidos. Los átomos BEAM nunca se recolectan y la tabla de átomos está limitada (aproximadamente 1.048.576 entradas por defecto). Un atacante que puede influir en la URL de una solicitud de Tesla - ya sea a través de una característica de reenvío de URL a nivel de aplicación (webhook, proxy, importador) o a través de un encabezado Location devuelto por un servidor cuando Tesla.Middleware.FollowRedirects está en la cadena de procesamiento - puede crear un nuevo átomo permanente por solicitud variando la cadena del esquema. Después de suficientes solicitudes, la tabla de átomos se llena y la VM falla, provocando la caída de toda la aplicación.\n\nEste problema afecta a tesla: desde 1.3.0 hasta antes de 1.18.3."
}
],
"id": "CVE-2026-48597",
"lastModified": "2026-09-24T21:17:13.573",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-48597",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T14:44:24.414813Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-02T20:16:38.710",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48597.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Broken Link"
],
"url": "https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/elixir-tesla/tesla/commit/ccd0823d4ba37581a37d8f6108f9a81b263237ef"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48597"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
} | — | ||||
| Product product | NVD | teslareceipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "tesla",
"packageURL": "pkg:hex/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "1.18.3",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "elixir-tesla/tesla",
"packageURL": "pkg:github/elixir-tesla/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e",
"status": "affected",
"version": "ccd0823d4ba37581a37d8f6108f9a81b263237ef",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA8CC181-83AA-4C5F-A01D-F04EC274E2FA",
"versionEndExcluding": "1.18.3",
"versionStartIncluding": "1.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.\n\nThis issue affects tesla: from 1.3.0 before 1.18.3."
},
{
"lang": "es",
"value": "Vulnerabilidad de asignación de recursos sin límites ni estrangulamiento en elixir-tesla tesla permite la denegación de servicio mediante el agotamiento de la tabla de átomos en Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 convierte el esquema de URL de cada solicitud saliente a un átomo BEAM mediante String.to_atom(uri.scheme) sin validación de lista de permitidos. Los átomos BEAM nunca se recolectan y la tabla de átomos está limitada (aproximadamente 1.048.576 entradas por defecto). Un atacante que puede influir en la URL de una solicitud de Tesla - ya sea a través de una característica de reenvío de URL a nivel de aplicación (webhook, proxy, importador) o a través de un encabezado Location devuelto por un servidor cuando Tesla.Middleware.FollowRedirects está en la cadena de procesamiento - puede crear un nuevo átomo permanente por solicitud variando la cadena del esquema. Después de suficientes solicitudes, la tabla de átomos se llena y la VM falla, provocando la caída de toda la aplicación.\n\nEste problema afecta a tesla: desde 1.3.0 hasta antes de 1.18.3."
}
],
"id": "CVE-2026-48597",
"lastModified": "2026-09-24T21:17:13.573",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-48597",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T14:44:24.414813Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-02T20:16:38.710",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48597.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Broken Link"
],
"url": "https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/elixir-tesla/tesla/commit/ccd0823d4ba37581a37d8f6108f9a81b263237ef"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48597"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
} | — | ||||
| Severity severity | NVD | MEDIUM From 4.0 to 6.9. receipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "tesla",
"packageURL": "pkg:hex/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "1.18.3",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "elixir-tesla/tesla",
"packageURL": "pkg:github/elixir-tesla/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e",
"status": "affected",
"version": "ccd0823d4ba37581a37d8f6108f9a81b263237ef",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA8CC181-83AA-4C5F-A01D-F04EC274E2FA",
"versionEndExcluding": "1.18.3",
"versionStartIncluding": "1.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.\n\nThis issue affects tesla: from 1.3.0 before 1.18.3."
},
{
"lang": "es",
"value": "Vulnerabilidad de asignación de recursos sin límites ni estrangulamiento en elixir-tesla tesla permite la denegación de servicio mediante el agotamiento de la tabla de átomos en Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 convierte el esquema de URL de cada solicitud saliente a un átomo BEAM mediante String.to_atom(uri.scheme) sin validación de lista de permitidos. Los átomos BEAM nunca se recolectan y la tabla de átomos está limitada (aproximadamente 1.048.576 entradas por defecto). Un atacante que puede influir en la URL de una solicitud de Tesla - ya sea a través de una característica de reenvío de URL a nivel de aplicación (webhook, proxy, importador) o a través de un encabezado Location devuelto por un servidor cuando Tesla.Middleware.FollowRedirects está en la cadena de procesamiento - puede crear un nuevo átomo permanente por solicitud variando la cadena del esquema. Después de suficientes solicitudes, la tabla de átomos se llena y la VM falla, provocando la caída de toda la aplicación.\n\nEste problema afecta a tesla: desde 1.3.0 hasta antes de 1.18.3."
}
],
"id": "CVE-2026-48597",
"lastModified": "2026-09-24T21:17:13.573",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-48597",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T14:44:24.414813Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-02T20:16:38.710",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48597.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Broken Link"
],
"url": "https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/elixir-tesla/tesla/commit/ccd0823d4ba37581a37d8f6108f9a81b263237ef"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48597"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
} | medium | ||||
| Status status | NVD | Modifiedreceipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "tesla",
"packageURL": "pkg:hex/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "1.18.3",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "elixir-tesla/tesla",
"packageURL": "pkg:github/elixir-tesla/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e",
"status": "affected",
"version": "ccd0823d4ba37581a37d8f6108f9a81b263237ef",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA8CC181-83AA-4C5F-A01D-F04EC274E2FA",
"versionEndExcluding": "1.18.3",
"versionStartIncluding": "1.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.\n\nThis issue affects tesla: from 1.3.0 before 1.18.3."
},
{
"lang": "es",
"value": "Vulnerabilidad de asignación de recursos sin límites ni estrangulamiento en elixir-tesla tesla permite la denegación de servicio mediante el agotamiento de la tabla de átomos en Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 convierte el esquema de URL de cada solicitud saliente a un átomo BEAM mediante String.to_atom(uri.scheme) sin validación de lista de permitidos. Los átomos BEAM nunca se recolectan y la tabla de átomos está limitada (aproximadamente 1.048.576 entradas por defecto). Un atacante que puede influir en la URL de una solicitud de Tesla - ya sea a través de una característica de reenvío de URL a nivel de aplicación (webhook, proxy, importador) o a través de un encabezado Location devuelto por un servidor cuando Tesla.Middleware.FollowRedirects está en la cadena de procesamiento - puede crear un nuevo átomo permanente por solicitud variando la cadena del esquema. Después de suficientes solicitudes, la tabla de átomos se llena y la VM falla, provocando la caída de toda la aplicación.\n\nEste problema afecta a tesla: desde 1.3.0 hasta antes de 1.18.3."
}
],
"id": "CVE-2026-48597",
"lastModified": "2026-09-24T21:17:13.573",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-48597",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T14:44:24.414813Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-02T20:16:38.710",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48597.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Broken Link"
],
"url": "https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/elixir-tesla/tesla/commit/ccd0823d4ba37581a37d8f6108f9a81b263237ef"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48597"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
} | — | ||||
| Technical impact technical_impact | NVD | partial The attacker gains limited control, or limited information. receipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "tesla",
"packageURL": "pkg:hex/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "1.18.3",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "elixir-tesla/tesla",
"packageURL": "pkg:github/elixir-tesla/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e",
"status": "affected",
"version": "ccd0823d4ba37581a37d8f6108f9a81b263237ef",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA8CC181-83AA-4C5F-A01D-F04EC274E2FA",
"versionEndExcluding": "1.18.3",
"versionStartIncluding": "1.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.\n\nThis issue affects tesla: from 1.3.0 before 1.18.3."
},
{
"lang": "es",
"value": "Vulnerabilidad de asignación de recursos sin límites ni estrangulamiento en elixir-tesla tesla permite la denegación de servicio mediante el agotamiento de la tabla de átomos en Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 convierte el esquema de URL de cada solicitud saliente a un átomo BEAM mediante String.to_atom(uri.scheme) sin validación de lista de permitidos. Los átomos BEAM nunca se recolectan y la tabla de átomos está limitada (aproximadamente 1.048.576 entradas por defecto). Un atacante que puede influir en la URL de una solicitud de Tesla - ya sea a través de una característica de reenvío de URL a nivel de aplicación (webhook, proxy, importador) o a través de un encabezado Location devuelto por un servidor cuando Tesla.Middleware.FollowRedirects está en la cadena de procesamiento - puede crear un nuevo átomo permanente por solicitud variando la cadena del esquema. Después de suficientes solicitudes, la tabla de átomos se llena y la VM falla, provocando la caída de toda la aplicación.\n\nEste problema afecta a tesla: desde 1.3.0 hasta antes de 1.18.3."
}
],
"id": "CVE-2026-48597",
"lastModified": "2026-09-24T21:17:13.573",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-48597",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T14:44:24.414813Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-02T20:16:38.710",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48597.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Broken Link"
],
"url": "https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/elixir-tesla/tesla/commit/ccd0823d4ba37581a37d8f6108f9a81b263237ef"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48597"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
} | — | ||||
| Vendor vendor | NVD | elixir-teslareceipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "tesla",
"packageURL": "pkg:hex/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "1.18.3",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.Tesla.Adapter.Mint'"
],
"packageName": "elixir-tesla/tesla",
"packageURL": "pkg:github/elixir-tesla/tesla",
"product": "tesla",
"programFiles": [
"lib/tesla/adapter/mint.ex"
],
"programRoutines": [
{
"name": "'Elixir.Tesla.Adapter.Mint':open_conn/2"
}
],
"repo": "https://github.com/elixir-tesla/tesla",
"vendor": "elixir-tesla",
"versions": [
{
"lessThan": "4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e",
"status": "affected",
"version": "ccd0823d4ba37581a37d8f6108f9a81b263237ef",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA8CC181-83AA-4C5F-A01D-F04EC274E2FA",
"versionEndExcluding": "1.18.3",
"versionStartIncluding": "1.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.\n\nThis issue affects tesla: from 1.3.0 before 1.18.3."
},
{
"lang": "es",
"value": "Vulnerabilidad de asignación de recursos sin límites ni estrangulamiento en elixir-tesla tesla permite la denegación de servicio mediante el agotamiento de la tabla de átomos en Tesla.Adapter.Mint.\n\nTesla.Adapter.Mint.open_conn/2 convierte el esquema de URL de cada solicitud saliente a un átomo BEAM mediante String.to_atom(uri.scheme) sin validación de lista de permitidos. Los átomos BEAM nunca se recolectan y la tabla de átomos está limitada (aproximadamente 1.048.576 entradas por defecto). Un atacante que puede influir en la URL de una solicitud de Tesla - ya sea a través de una característica de reenvío de URL a nivel de aplicación (webhook, proxy, importador) o a través de un encabezado Location devuelto por un servidor cuando Tesla.Middleware.FollowRedirects está en la cadena de procesamiento - puede crear un nuevo átomo permanente por solicitud variando la cadena del esquema. Después de suficientes solicitudes, la tabla de átomos se llena y la VM falla, provocando la caída de toda la aplicación.\n\nEste problema afecta a tesla: desde 1.3.0 hasta antes de 1.18.3."
}
],
"id": "CVE-2026-48597",
"lastModified": "2026-09-24T21:17:13.573",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-48597",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T14:44:24.414813Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-02T20:16:38.710",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48597.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Broken Link"
],
"url": "https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/elixir-tesla/tesla/commit/ccd0823d4ba37581a37d8f6108f9a81b263237ef"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48597"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
} | — |