EEF-CVE-2026-94201

See a problem?
Please try reporting it to the source first.
Source
https://cna.erlef.org/osv/EEF-CVE-2026-94201.html
Import Source
https://cna.erlef.org/osv/EEF-CVE-2026-94201.json
JSON Data
https://api.test.osv.dev/v1/vulns/EEF-CVE-2026-94201
Aliases
  • CVE-2026-94201
Published
2026-10-05T19:19:51Z
Modified
2026-10-05T19:30:04Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash
Details

Summary

Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through Ash.Type.Atom. Because the type defined no coerce/2 callback, coercion fell back to the default (cast_input/2), which calls String.to_atom/1 when the attribute is configured with the unsafe_to_atom?: true constraint.

Filtering such an attribute with attacker-controlled strings therefore interned a new, permanent atom for every distinct value. Atoms are never garbage collected and the BEAM caps the atom table, so an actor who can supply filter values for a public, filterable :atom attribute declared with unsafe_to_atom?: true can exhaust the atom table and crash the node (denial of service). AshPaperTrail is a notable example: its version resources expose a public, filterable version_action_name atom attribute with unsafe_to_atom?: true by default.

The fix adds a coerce/2 to Ash.Type.Atom that never interns atoms — a comparison value is left as a string, since the type is stored and compared as a string. Setting the attribute from action input (cast_input/2, which still honors unsafe_to_atom?) is unchanged.

This issue affects ash: from 3.5.1 before 3.34.3.

Configurations

Reachable only when an application exposes a public, filterable :atom attribute declared with the unsafe_to_atom?: true constraint, and an actor can supply filter values for it (for example through AshGraphql, AshJsonApi, or Ash.Query.filter_input/2). AshPaperTrail's version resources ship such an attribute (version_action_name) by default.

Database specific 
{
    "capec_ids": [
        "CAPEC-130"
    ],
    "cpe_ids": [
        "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids": [
        "CWE-770"
    ]
}
References
Credits
    • Quinn Wilton - FINDER
    • Quinn Wilton - REPORTER
    • Zach Daniel / Ash Project - REMEDIATION_DEVELOPER
    • Jonatan Männchen / EEF - COORDINATOR

Affected packages

Hex / ash

Package

Name
ash
Purl
pkg:hex/ash

Affected ranges

Type
SEMVER
Events
Introduced
3.5.1
Fixed
3.34.3

Affected versions

3.*
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.5.10
3.5.11
3.5.12
3.5.13
3.5.14
3.5.15
3.5.16
3.5.17
3.5.18
3.5.19
3.5.20
3.5.21
3.5.22
3.5.23
3.5.24
3.5.25
3.5.26
3.5.27
3.5.28
3.5.29
3.5.30
3.5.31
3.5.32
3.5.33
3.5.34
3.5.35
3.5.36
3.5.37
3.5.38
3.5.39
3.5.40
3.5.41
3.5.42
3.5.43
3.6.0
3.6.1
3.6.2
3.6.3
3.7.0
3.7.1
3.7.2
3.7.3
3.7.4
3.7.5
3.7.6
3.8.0
3.9.0
3.10.0
3.10.1
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.13.0
3.13.1
3.13.2
3.14.0
3.14.1
3.15.0
3.16.0
3.17.0
3.17.1
3.18.0
3.19.0
3.19.1
3.19.2
3.19.3
3.20.0
3.21.0
3.21.1
3.21.2
3.21.3
3.22.0
3.22.1
3.22.2
3.23.0
3.23.1
3.24.0
3.24.1
3.24.2
3.24.3
3.24.4
3.24.5
3.24.6
3.24.7
3.25.0
3.25.1
3.25.2
3.26.0
3.27.0
3.27.1
3.27.2
3.27.3
3.27.4
3.27.5
3.27.6
3.27.7
3.27.8
3.28.0
3.29.0
3.29.1
3.29.2
3.29.3
3.30.0
3.30.1
3.31.0
3.31.1
3.31.2
3.31.3
3.32.0
3.32.1
3.32.2
3.32.3
3.33.0
3.33.1
3.33.2
3.33.3
3.33.4
3.33.5
3.33.6
3.33.7
3.33.8
3.33.9
3.33.10
3.33.11
3.34.0
3.34.1
3.34.2

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-94201.json"

Git / github.com/ash-project/ash

Affected ranges

Type
GIT
Repo
https://github.com/ash-project/ash
Events
Introduced
2970ba3bd5d36d6ad04c731ac87385375d457147
Fixed
5282f3f513053628cdd1bf2236ea22d975d934d4

Affected versions

v3.*
v3.10.0
v3.10.1
v3.11.0
v3.11.1
v3.11.2
v3.11.3
v3.12.0
v3.13.0
v3.13.1
v3.13.2
v3.14.0
v3.14.1
v3.15.0
v3.16.0
v3.17.0
v3.17.1
v3.18.0
v3.19.0
v3.19.1
v3.19.2
v3.19.3
v3.20.0
v3.21.0
v3.21.1
v3.21.2
v3.21.3
v3.22.0
v3.22.1
v3.22.2
v3.23.0
v3.23.1
v3.24.0
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.24.5
v3.24.6
v3.24.7
v3.25.0
v3.25.1
v3.25.2
v3.26.0
v3.27.0
v3.27.1
v3.27.2
v3.27.3
v3.27.4
v3.27.6
v3.27.7
v3.27.8
v3.28.0
v3.29.0
v3.29.1
v3.29.2
v3.29.3
v3.30.0
v3.30.1
v3.31.0
v3.31.1
v3.31.2
v3.31.3
v3.32.1
v3.32.2
v3.32.3
v3.33.1
v3.33.10
v3.33.11
v3.33.2
v3.33.3
v3.33.4
v3.33.5
v3.33.6
v3.33.7
v3.33.9
v3.34.0
v3.34.1
v3.34.2
v3.5.1
v3.5.10
v3.5.11
v3.5.12
v3.5.13
v3.5.14
v3.5.15
v3.5.16
v3.5.17
v3.5.18
v3.5.19
v3.5.2
v3.5.21
v3.5.22
v3.5.23
v3.5.24
v3.5.25
v3.5.26
v3.5.27
v3.5.28
v3.5.29
v3.5.3
v3.5.30
v3.5.31
v3.5.32
v3.5.33
v3.5.35
v3.5.36
v3.5.37
v3.5.38
v3.5.39
v3.5.4
v3.5.41
v3.5.42
v3.5.43
v3.5.5
v3.5.6
v3.5.7
v3.5.8
v3.6.0
v3.6.1
v3.6.2
v3.6.3
v3.7.0
v3.7.1
v3.7.2
v3.7.3
v3.7.4
v3.7.5
v3.7.6
v3.8.0
v3.9.0

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-94201.json"