Most recent entries from all

EUVD-2026-280112

2026-10-15T06:50:51.422488+00:00

EUVD-2026-280112

fkie_cve-2026-34593

2026-10-15T06:50:51.422518+00:00

Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type.Module.cast_input/2 unconditionally creates a new Erlang atom via Module.concat([value]) for any user-supplied binary string that starts with "Elixir.", before verifying whether the referenced module exists. Because Erlang atoms are never garbage-collected and the BEAM atom table has a hard default limit of approximately 1,048,576 entries, an attacker who can submit values to any resource attribute or argument of type :module can exhaust this table and crash the entire BEAM VM, taking down the application. This issue has been patched in version 3.22.0.

GHSA-jjf9-w5vj-r6vp — Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash

2026-10-15T06:50:51.422551+00:00

Affected: Hex: ash

## Summary

`Ash.Type.Module.cast_input/2` unconditionally creates a new Erlang atom via `Module.concat([value])` for any user-supplied binary string that starts with `"Elixir."`, before verifying whether the referenced module exists. Because Erlang atoms are never garbage-collected and the BEAM atom table has a hard default limit of approximately 1,048,576 entries, an attacker who can submit values to any resource attribute or argument of type `:module` can exhaust this table and crash the entire BEAM VM, taking down the application.

## Details

**Setup**: A resource with a `:module`-typed attribute exposed to user input, which is a supported and documented usage of the `Ash.Type.Module` built-in type:

```elixir defmodule MyApp.Widget do use Ash.Resource, domain: MyApp, data_layer: AshPostgres.DataLayer

attributes do uuid_primary_key :id attribute :handler_module, :module, public?: true end

actions do defaults [:read, :destroy] create :create do accept [:handler_module] end end end ```

**Vulnerable code** in `lib/ash/type/module.ex`, lines 105-113:

```elixir def cast_input("Elixir." <> _ = value, _) do module = Module.concat([value]) # <-- Creates new atom unconditionally if Code.ensure_loaded?(module) do {:ok, module} else :error # <-- Returns error but atom is already created end end ```

**Exploit**: Submit repeated `Ash.create` requests (e.g., via a JSON API endpoint) with unique `"Elix…