CVE-2026-34593: Ash Framework Denial of Service via Atom Exhaustion in Module Type

CVE-2026-34593 · Severity: high · CVSS 7.5 · Published 2026-04-02

Ash Framework is a tool used to build applications in the Elixir programming language. A flaw in how it handles certain input allows an attacker to force the application to create an unlimited number of internal identifiers called 'atoms.' Because these identifiers are never cleaned up and have a fixed limit, an attacker can intentionally exhaust them to crash the entire application and the server it runs on, leading to a complete service outage.

Technologies: Ash-Hq Ash Framework, Erlang Ash. Vendors: Ash-Hq, Erlang.

Quick answers

Is CVE-2026-34593 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34593 being exploited in the wild.
How severe is CVE-2026-34593?
High severity, with a CVSS score of 7.5, published 2 April 2026.
Which products and versions are affected?
Erlang Ash <= 3.21.3.
Is there a fix for CVE-2026-34593?
A patch was published on 2026-03-29: Version 3.22.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34593 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-34593?
Check whether you run Ash-Hq Ash Framework or Erlang Ash at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial of service vulnerability exists in Ash Framework's `Ash.Type.Module.cast_input/2` and `cast_stored/2` functions. The framework unconditionally calls `Module.concat/1` on user-supplied strings starting with "Elixir.", which creates new Erlang atoms before verifying if the module exists. Since Erlang atoms are not garbage-collected and the BEAM VM has a hard limit (default ~1M), a remote, unauthenticated attacker can exhaust the atom table by submitting unique strings to any resource attribute or argument of type `:module`. This results in a non-recoverable crash of the entire BEAM VM. The issue is fixed in version 3.22.0 by ensuring atoms are not created for non-existent modules.

Affected products

  • ash-project Ash Framework < 3.22.0

Identifiers

  • CVE-2026-34593
  • GHSA-jjf9-w5vj-r6vp

Timeline

  • 2026-03-29: patched: Version 3.22.0 released
  • 2026-03-29: advisory: GitHub Security Advisory published
  • 2026-04-02: disclosed: CVE-2026-34593 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.