EUVD-2026-68929Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable RPC with no auth or interaction required; sole impact is complete availability loss (node abort); no confidentiality or integrity effect.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
4DescriptionCVE.org
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names.
AshTypescript.FieldFormatter.convert_to_field_atom/2 in lib/ash_typescript/field_formatter.ex converts a client-supplied field name to an atom with String.to_atom/1 when no matching atom already exists. It delegates first to parse_input_field/2, which resolves the name with String.to_existing_atom/1 and falls back to returning the plain string; convert_to_field_atom/2 then mints an atom from that string rather than treating the name as unknown.
RPC field selection reaches it for every requested field name through AshTypescript.Rpc.FieldProcessing.FieldSelector, which resolves each name before checking that the field exists, with no allowlist, length bound, or rate limit. Atoms are never garbage collected, so each distinct name mints a permanent one and the VM aborts once the atom table limit is reached. A field name over 255 characters additionally raises an uncaught SystemLimitError.
This issue affects ash_typescript: from 0.1.0 before 0.18.0.
AnalysisAI
Unauthenticated atom table exhaustion in ash_typescript 0.1.0-0.17.x allows any network attacker to crash the entire Erlang/BEAM node by submitting RPC requests with attacker-controlled field names. The library's convert_to_field_atom/2 function calls String.to_atom/1 on client-supplied strings without validation, minting permanent, non-garbage-collected atoms until the VM hits its table limit and aborts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for the primary atom-exhaustion path - any unauthenticated attacker with network access to the ash_typescript RPC endpoint can trigger it against a default deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) accurately reflects the threat model: low-complexity, unauthenticated, network-reachable, with complete availability impact and no confidentiality or integrity effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to ash_typescript 0.18.0 or later, which replaces `convert_to_field_atom/2` with `resolve_field_name/2` - a function that never calls `String.to_atom/1` on client-supplied input and instead returns unresolved strings unchanged, allowing downstream field validation to reject unknown names. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of all services running ash_typescript versions 0.1.0 through 0.17.x across production and non-production environments using dependency scanning and deployment records. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ash Typescript
View allUnauthenticated BEAM atom table exhaustion in ash_typescript 0.11.0-0.17.x allows a remote attacker to abort the Erlang
Field policy enforcement in ash_typescript RPC serialization is bypassed by a missing pattern-match clause, allowing una
Constraint bypass in ash_typescript typed-controller routes allows remote attackers to submit argument values outside de
Sensitive application data leaks from HTTP 500 responses in ash_typescript versions 0.15.0 through 0.17.x due to an unga
Sensitive internal error data - including runtime secrets potentially carried in Ash error vars fields - leaks to unauth
Open redirect in ash_typescript's TypeScript client code generator allows an attacker who controls a path-parameter valu
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today