https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 06:50:33 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-280112 EUVD-2026-280112 https://cve.radiocsirt.org/vuln/euvd-2026-280112 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34593 <p>Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type.Module.cast_input/2 unconditionally creates a new Erlang atom via Module.concat([value]) for any user-supplied binary string that starts with &#34;Elixir.&#34;, before verifying whether the referenced module exists. Because Erlang atoms are never garbage-collected and the BEAM atom table has a hard default limit of approximately 1,048,576 entries, an attacker who can submit values to any resource attribute or argument of type :module can exhaust this table and crash the entire BEAM VM, taking down the application. This issue has been patched in version 3.22.0.</p> <p>Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type.Module.cast_input/2 unconditionally creates a new Erlang atom via Module.concat([value]) for any user-supplied binary string that starts with &#34;Elixir.&#34;, before verifying whether the referenced module exists. Because Erlang atoms are never garbage-collected and the BEAM atom table has a hard default limit of approximately 1,048,576 entries, an attacker who can submit values to any resource attribute or argument of type :module can exhaust this table and crash the entire BEAM VM, taking down the application. This issue has been patched in version 3.22.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34593 https://cve.radiocsirt.org/vuln/ghsa-jjf9-w5vj-r6vp <p><strong>Affected:</strong> Hex: ash</p> <p>## Summary</p> <p>`Ash.Type.Module.cast_input/2` unconditionally creates a new Erlang atom via `Module.concat([value])` for any user-supplied binary string that starts with `&#34;Elixir.&#34;`, before verifying whether the referenced module exists. Because Erlang atoms are never garbage-collected and the BEAM atom table has a hard default limit of approximately 1,048,576 entries, an attacker who can submit values to any resource attribute or argument of type `:module` can exhaust this table and crash the entire BEAM VM, taking down the application.</p> <p>## Details</p> <p>**Setup**: A resource with a `:module`-typed attribute exposed to user input, which is a supported and documented usage of the `Ash.Type.Module` built-in type:</p> <p>```elixir defmodule MyApp.Widget do use Ash.Resource, domain: MyApp, data_layer: AshPostgres.DataLayer</p> <p>attributes do uuid_primary_key :id attribute :handler_module, :module, public?: true end</p> <p>actions do defaults [:read, :destroy] create :create do accept [:handler_module] end end end ```</p> <p>**Vulnerable code** in `lib/ash/type/module.ex`, lines 105-113:</p> <p>```elixir def cast_input(&#34;Elixir.&#34; &lt;&gt; _ = value, _) do module = Module.concat([value]) # &lt;-- Creates new atom unconditionally if Code.ensure_loaded?(module) do {:ok, module} else :error # &lt;-- Returns error but atom is already created end end ```</p> <p>**Exploit**: Submit repeated `Ash.create` requests (e.g., via a JSON API endpoint) with unique `&#34;Elix…</p> <p><strong>Affected:</strong> Hex: ash</p> <p>## Summary</p> <p>`Ash.Type.Module.cast_input/2` unconditionally creates a new Erlang atom via `Module.concat([value])` for any user-supplied binary string that starts with `&#34;Elixir.&#34;`, before verifying whether the referenced module exists. Because Erlang atoms are never garbage-collected and the BEAM atom table has a hard default limit of approximately 1,048,576 entries, an attacker who can submit values to any resource attribute or argument of type `:module` can exhaust this table and crash the entire BEAM VM, taking down the application.</p> <p>## Details</p> <p>**Setup**: A resource with a `:module`-typed attribute exposed to user input, which is a supported and documented usage of the `Ash.Type.Module` built-in type:</p> <p>```elixir defmodule MyApp.Widget do use Ash.Resource, domain: MyApp, data_layer: AshPostgres.DataLayer</p> <p>attributes do uuid_primary_key :id attribute :handler_module, :module, public?: true end</p> <p>actions do defaults [:read, :destroy] create :create do accept [:handler_module] end end end ```</p> <p>**Vulnerable code** in `lib/ash/type/module.ex`, lines 105-113:</p> <p>```elixir def cast_input(&#34;Elixir.&#34; &lt;&gt; _ = value, _) do module = Module.concat([value]) # &lt;-- Creates new atom unconditionally if Code.ensure_loaded?(module) do {:ok, module} else :error # &lt;-- Returns error but atom is already created end end ```</p> <p>**Exploit**: Submit repeated `Ash.create` requests (e.g., via a JSON API endpoint) with unique `&#34;Elix…</p> https://cve.radiocsirt.org/vuln/ghsa-jjf9-w5vj-r6vp