# CVE-2026-48597: Elixir Tesla denial of service in Tesla.Adapter.Mint

Source: https://junglewise.ai/threats/cve-2026-48597-elixir-tesla-denial-of-service-in-tesla-adapter-mint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-48597 · Severity: high · CVSS 8.2 · Published 2026-06-02

A vulnerability in the Tesla HTTP client library for Elixir can allow an attacker to crash the entire application. By sending requests with many different custom URL schemes, an attacker can exhaust the server's memory for internal identifiers, leading to a complete service outage. This affects applications that forward user-provided URLs or follow redirects to untrusted websites.

## Quick answers

**Is CVE-2026-48597 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48597 being exploited in the wild.

**How severe is CVE-2026-48597?** High severity, with a CVSS score of 8.2, published 2 June 2026.

**Which products and versions are affected?** elixir-tesla tesla >= 1.3.0, < 1.18.3.

**Is there a fix for CVE-2026-48597?** A patch was published on 2026-07-10: Fixed in version 1.18.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48597 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48597?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Tesla HTTP client library, specifically when using the Mint adapter, is vulnerable to atom exhaustion. The `Tesla.Adapter.Mint.open_conn/2` function passes the URL scheme of outgoing requests directly to `String.to_atom/1` without validation. In the Erlang VM (BEAM), atoms are not garbage-collected and have a fixed limit (approx. 1 million). An attacker can trigger the creation of new atoms by providing unique URL schemes in features like webhooks or by redirecting the client to a malicious server with a novel scheme. Once the atom table is exhausted, the VM crashes. This is fixed in version 1.18.3.

## Affected products

- elixir-tesla tesla >= 1.3.0, < 1.18.3

## Identifiers

- CVE-2026-48597
- GHSA-h74c-q9j7-mpcm

## Timeline

- 2026-06-02: disclosed: Initial disclosure and NVD publication
- 2026-07-10: advisory: GitHub Advisory published/reviewed
- 2026-07-10: patched: Fixed in version 1.18.3

## References

- [https://api.github.com/users/PJUllrich](https://api.github.com/users/PJUllrich)
- [https://github.com/PJUllrich](https://github.com/PJUllrich)
- [https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D](https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D)
- [https://api.github.com/users/PJUllrich/repos](https://api.github.com/users/PJUllrich/repos)
- [https://avatars.githubusercontent.com/u/10426523?v=4](https://avatars.githubusercontent.com/u/10426523?v=4)
- [https://api.github.com/users/PJUllrich/events%7B/privacy%7D](https://api.github.com/users/PJUllrich/events%7B/privacy%7D)