PT-2026-29495 · Unknown · Ash Framework
Fg0X0
·
Published
2026-04-01
·
Updated
2026-04-02
·
CVE-2026-34593
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Ash Framework versions prior to 3.22.0
Ash Framework is susceptible to a denial of service due to uncontrolled Erlang atom creation. The
Ash.Type.Module.cast input/2 function unconditionally creates a new Erlang atom using Module.concat([value]) for any user-supplied binary string starting with 'Elixir.', without first verifying the module's existence. Since Erlang atoms are never garbage collected and the BEAM virtual machine has a limit on the number of atoms, an attacker can exhaust the atom table by submitting numerous unique 'Elixir.' strings through any resource attribute or argument of type :module, leading to a crash of the BEAM VM and a denial of service. The vulnerable code is located in lib/ash/type/module.ex, lines 105-113 and 141. An attacker can exploit this by submitting repeated Ash.create requests with unique 'Elixir.' strings via an API endpoint. The issue also occurs when reading :module-typed values from the database if an attacker can write arbitrary 'Elixir.*' strings to the relevant database column.To resolve this, update to version 3.22.0 or later. As a temporary workaround, avoid using the :module type for user-supplied input or restrict access to resources with :module-typed attributes.
Exploit
Fix
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ash Framework