Executive brief
A vulnerability in the Tesla HTTP client library for Elixir can allow an attacker to crash the entire application. By sending requests with many different custom URL schemes, an attacker can exhaust the server's memory for internal identifiers, leading to a complete service outage. This affects applications that forward user-provided URLs or follow redirects to untrusted websites.
Technical details
The Tesla HTTP client library, specifically when using the Mint adapter, is vulnerable to atom exhaustion. The `Tesla.Adapter.Mint.open_conn/2` function passes the URL scheme of outgoing requests directly to `String.to_atom/1` without validation. In the Erlang VM (BEAM), atoms are not garbage-collected and have a fixed limit (approx. 1 million). An attacker can trigger the creation of new atoms by providing unique URL schemes in features like webhooks or by redirecting the client to a malicious server with a novel scheme. Once the atom table is exhausted, the VM crashes. This is fixed in version 1.18.3.
Affected products
- elixir-tesla tesla >= 1.3.0, < 1.18.3
Timeline
- 2026-06-02: disclosed: Initial disclosure and NVD publication
- 2026-07-10: advisory: GitHub Advisory published/reviewed
- 2026-07-10: patched: Fixed in version 1.18.3