Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type.Module.cast_input/2 unconditionally creates a new Erlang atom via Module.concat([value]) for any user-supplied binary string that starts with "Elixir.", before verifying whether the referenced module exists. Because Erlang atoms are never garbage-collected and the BEAM atom table has a hard default limit of approximately 1,048,576 entries, an attacker who can submit values to any resource attribute or argument of type :module can exhaust this table and crash the entire BEAM VM, taking down the application. This issue has been patched in version 3.22.0.
References
| Link | Resource |
|---|---|
| https://github.com/ash-project/ash/releases/tag/v3.22.0 | Product Release Notes |
| https://github.com/ash-project/ash/security/advisories/GHSA-jjf9-w5vj-r6vp | Vendor Advisory Exploit |
| https://github.com/ash-project/ash/security/advisories/GHSA-jjf9-w5vj-r6vp | Vendor Advisory Exploit |
Configurations
History
13 Apr 2026, 18:37
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:ash-hq:ash_framework:*:*:*:*:*:*:*:* | |
| CWE | CWE-770 | |
| First Time |
Ash-hq ash Framework
Ash-hq |
|
| References | () https://github.com/ash-project/ash/releases/tag/v3.22.0 - Product, Release Notes | |
| References | () https://github.com/ash-project/ash/security/advisories/GHSA-jjf9-w5vj-r6vp - Vendor Advisory, Exploit | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
03 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/ash-project/ash/security/advisories/GHSA-jjf9-w5vj-r6vp - |
02 Apr 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-02 18:16
Updated : 2026-04-13 18:37
NVD link : CVE-2026-34593
Mitre link : CVE-2026-34593
CVE.ORG link : CVE-2026-34593
JSON object : View
Products Affected
ash-hq
- ash_framework