The vulnerability in elixir-tesla's Tesla.Adapter.Mint.open_conn/2 function involves converting the URL scheme of outgoing requests into BEAM atoms using String.to_atom(uri.scheme) without any allow-list validation. Because BEAM atoms are not garbage-collected and the atom table has a fixed size limit (~1,048,576 entries), an attacker able to influence the URL scheme—via application-level URL forwarding features or redirect headers—can cause the creation of many unique atoms. This leads to atom table exhaustion and a crash of the Erlang VM, resulting in a denial of service. The issue affects tesla versions starting at 1.3.0 up to but not including 1.18.3. The CVSS 4.0 score is 8.2, indicating high severity. No vendor advisory or patch links are currently available, and the remediation level is not specified.

Successful exploitation results in denial of service by crashing the Erlang VM hosting the application due to atom table exhaustion. This can cause application downtime and service disruption. There is no indication of privilege escalation, data disclosure, or other impacts beyond denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted or attacker-controlled URLs that influence the URL scheme in Tesla requests. Consider disabling or restricting features that allow URL forwarding or automatic redirect following if they can be influenced by untrusted input.