CVE-2026-48597

@@ -150,26 +150,32 @@ if Code.ensure_loaded?(Mint.HTTP) do
     end
 
     defp open_conn(uri, opts) do
-      opts =
-        with "https" <- uri.scheme,
-             global_cacertfile when not is_nil(global_cacertfile) <-
-               Application.get_env(:tesla, Tesla.Adapter.Mint)[:cacert] do
-          Map.update(opts, :transport_opts, [cacertfile: global_cacertfile], fn tr_opts ->
-            Keyword.put_new(tr_opts, :cacertfile, global_cacertfile)
-          end)
-        else
-          _ -> opts
-        end
+      with {:ok, scheme} <- parse_scheme(uri.scheme) do
+        opts =
+          with :https <- scheme,
+               global_cacertfile when not is_nil(global_cacertfile) <-
+                 Application.get_env(:tesla, Tesla.Adapter.Mint)[:cacert] do
+            Map.update(opts, :transport_opts, [cacertfile: global_cacertfile], fn tr_opts ->
+              Keyword.put_new(tr_opts, :cacertfile, global_cacertfile)
+            end)
+          else
+            _ -> opts
+          end
 
-      opts = Map.put_new(opts, :mode, :passive)
+        opts = Map.put_new(opts, :mode, :passive)
 
-      with {:ok, conn} <-
-             HTTP.connect(String.to_atom(uri.scheme), uri.host, uri.port, Enum.into(opts, [])) do
-        # If there were redirects, and passed `closed_conn: false`, we need to close opened connections to these intermediate hosts.
-        {:ok, conn, Map.put(opts, :close_conn, true)}
+        with {:ok, conn} <-
+               HTTP.connect(scheme, uri.host, uri.port, Enum.into(opts, [])) do
+          # If there were redirects, and passed `closed_conn: false`, we need to close opened connections to these intermediate hosts.
+          {:ok, conn, Map.put(opts, :close_conn, true)}
+        end
       end
     end
 
+    defp parse_scheme("http"), do: {:ok, :http}
+    defp parse_scheme("https"), do: {:ok, :https}
+    defp parse_scheme(_), do: {:error, :unsupported_scheme}
+
     defp make_request(conn, method, path, headers, body) when is_function(body) do
       with {:ok, conn, ref} <-
              HTTP.request(

@@ -63,6 +63,19 @@ defmodule Tesla.Adapter.MintTest do
     assert conn.state == :closed
   end
 
+  test "unsupported scheme does not mint atoms" do
+    request = %Env{
+      method: :get,
+      url: "atk-#{:erlang.unique_integer([:positive])}://127.0.0.1/"
+    }
+
+    before_count = :erlang.system_info(:atom_count)
+    assert {:error, :unsupported_scheme} = call(request)
+    after_count = :erlang.system_info(:atom_count)
+
+    assert after_count == before_count
+  end
+
   test "certificates_verification" do
     request = %Env{
       method: :get,