Executive brief
ash_cloak is an Elixir library used to encrypt sensitive columns in databases. A vulnerability allows attackers who can modify encrypted data to crash the application server by creating a malformed payload that either exhausts the atom table through unbounded atom creation or inflates a compressed payload into gigabytes of memory, causing a denial of service.
Technical details
The vulnerability is a deserialization of untrusted data flaw in AshCloak.Calculations.Decrypt, which decodes encrypted binaries using Ash.Helpers.non_executable_binary_to_term/1 without the :safe option. This causes atoms in the payload to be interned during decoding and never garbage collected, and compressed terms are transparently decompressed. The attack is enabled by the unauthenticated AES.CTR cipher, where an attacker knowing their own plaintext can XOR it into any same-length payload without possessing the encryption key. An attacker can craft a payload with hundreds of kilobytes of distinct atoms to exhaust the atom table, or embed a small highly-compressed payload that expands to gigabytes during decryption, triggering a BEAM node crash. Versions 0.1.0 through 0.3.x are affected; 0.4.0 contains a fix.
Affected products
- ash-project ash_cloak 0.1.0 to 0.3.x
Timeline
- 2026-08-30: disclosed