Executive brief
ash_admin is an admin panel library for the Ash data framework. An unauthenticated attacker with network access to the admin LiveView can crash the entire Erlang VM (and all applications running on it) by flooding event handlers with random inputs, exhausting the atom table which has a hard system limit and cannot be garbage collected.
Technical details
This is an Allocation of Resources Without Limits or Throttling vulnerability (CWE-770) in two LiveView event handlers. The AshAdmin.PageLive.set_actor handler converts client-supplied resource and domain names into atoms using Module.concat/1, and AshAdmin.Components.Resource.Show.calculate converts submitted form keys into atoms using String.to_atom/1. Since atoms are never garbage collected in the BEAM VM and the atom table has a fixed capacity, an attacker can mint a new atom per request with random strings until the VM runs out of atom slots and terminates. No authentication is required—the attack succeeds against any client with network access to the admin interface. The fix validates submitted resource/domain values against known resources and maps form keys to declared arguments, preventing arbitrary atom creation.
Affected products
- ash-project ash_admin from 0.1.0 before 1.3.1
Timeline
- 2026-08-31: disclosed