EUVD-2026-68281Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via AES.CTR forgery path; AC:H because AES.CTR must be explicitly configured; PR:L because attacker requires application user credentials to read and write encrypted columns.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption.
AshCloak.Calculations.Decrypt decodes the decrypted binary with Ash.Helpers.non_executable_binary_to_term/1 without the :safe option, so atoms in the payload are interned during the decode and never garbage collected, and the term format's compressed form is inflated transparently. vault.decrypt!() is the only barrier and stops tampering only for an authenticated cipher. Cloak also ships the unauthenticated AES.CTR, whose ciphertext an attacker who knows their own plaintext can XOR into any same-length payload without the key, so an ordinary read of the forged column reaches the decoder. A few hundred kilobytes of distinct atoms exhausts the atom table, or a small compressed payload inflates to gigabytes.
This issue affects ash_cloak: from 0.1.0 before 0.4.0.
AnalysisAI
Unsafe Erlang term deserialization in ash_cloak 0.1.0-0.3.x allows an attacker who can influence encrypted column bytes to crash the BEAM runtime node via unbounded atom table exhaustion or a decompression bomb. Applications configured with Cloak's unauthenticated AES.CTR cipher are the highest-risk targets: an authenticated application user who knows their own plaintext can XOR-derive the keystream and write a forged ciphertext of equal length without the encryption key, causing the deserialization to fire on any subsequent column read. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The primary (network-reachable) attack path requires two conditions to both be true: (1) the application has configured Cloak's unauthenticated AES.CTR cipher for at least one encrypted column - this is a non-default cipher that must be explicitly selected in the Cloak configuration; and (2) the attacker holds application-layer credentials sufficient to read the ciphertext of their own encrypted column value and write a forged column value of the same byte length back to the datastore. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The reported CVSS 4.0 score of 5.9 with AV:L models the conservative scenario requiring local or direct database write access, but the description explicitly documents a more accessible attack path: an application-layer user with AES.CTR-encrypted columns can forge ciphertext over the network without key material. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_cloak to version 0.4.0 or later, which closes both attack primitives: the fix rejects all compressed ETF payloads outright (matching magic bytes <<131, 80>>) before deserialization, and passes the :safe option to binary_to_term to prevent interning of attacker-supplied atoms. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today