Executive brief
Ash Framework is a tool used to build applications in the Elixir programming language. A flaw in how it handles certain input allows an attacker to force the application to create an unlimited number of internal identifiers called 'atoms.' Because these identifiers are never cleaned up and have a fixed limit, an attacker can intentionally exhaust them to crash the entire application and the server it runs on, leading to a complete service outage.
Technical details
A denial of service vulnerability exists in Ash Framework's `Ash.Type.Module.cast_input/2` and `cast_stored/2` functions. The framework unconditionally calls `Module.concat/1` on user-supplied strings starting with "Elixir.", which creates new Erlang atoms before verifying if the module exists. Since Erlang atoms are not garbage-collected and the BEAM VM has a hard limit (default ~1M), a remote, unauthenticated attacker can exhaust the atom table by submitting unique strings to any resource attribute or argument of type `:module`. This results in a non-recoverable crash of the entire BEAM VM. The issue is fixed in version 3.22.0 by ensuring atoms are not created for non-existent modules.
Affected products
- ash-project Ash Framework < 3.22.0
Timeline
- 2026-03-29: patched: Version 3.22.0 released
- 2026-03-29: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE-2026-34593 published to NVD