elixir-tesla up to 1.18.2 Location Header Tesla.Adapter.Mint allocation of resources

Summaryinfo

A vulnerability, which was classified as problematic, has been found in elixir-tesla tesla up to 1.18.2. Affected by this issue is the function Tesla.Adapter.Mint of the component Location Header Handler. Performing a manipulation results in allocation of resources. This vulnerability is identified as CVE-2026-48597. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in elixir-tesla tesla up to 1.18.2. It has been classified as problematic. This affects the function Tesla.Adapter.Mint of the component Location Header Handler. The manipulation with an unknown input leads to a allocation of resources vulnerability. CWE is classifying the issue as CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. This is going to have an impact on availability. The summary by CVE is:

Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint. Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application. This issue affects tesla: from 1.3.0 before 1.18.3.

The weakness was released by Peter Ullrich and Jonatan Männchen as GHSA-h74c-q9j7-mpcm. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-48597 since 05/22/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 1.18.3 eliminates this vulnerability. Applying the patch 4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Vehicle Software

Vendor

• elixir-tesla

Name

• tesla

Version

• 1.18.0
• 1.18.1
• 1.18.2

License

• open-source

Website

• Product: https://github.com/elixir-tesla/tesla/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion