The vulnerability arises in Tesla.Adapter.Mint.open_conn/2, which converts the URL scheme of every outgoing request to a BEAM atom using String.to_atom(uri.scheme) without any allow-list validation. Since BEAM atoms are permanent and the atom table is bounded (approximately 1,048,576 entries), an attacker able to influence the URL scheme—via application-level URL forwarding or redirect middleware—can cause the creation of many unique atoms. This atom table exhaustion results in a denial of service by crashing the Erlang VM hosting the application. The issue affects tesla version 1.3.0 and versions before 1.18.3.

An attacker who can control or influence the URL scheme in requests made by tesla can cause the application to exhaust the BEAM atom table, leading to a denial of service by crashing the Erlang VM. This results in application downtime and potential disruption of services relying on tesla for HTTP requests.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted or attacker-controlled URL schemes to tesla requests, and consider disabling or carefully controlling middleware that follows redirects or processes URLs from untrusted sources. Monitor for updates from the elixir-tesla project regarding an official fix.