ash_cloak CVE-2026-81319

The primary (network-reachable) attack path requires two conditions to both be true: (1) the application has configured Cloak's unauthenticated AES.CTR cipher for at least one encrypted column - this is a non-default cipher that must be explicitly selected in the Cloak configuration; and (2) the attacker holds application-layer credentials sufficient to read the ciphertext of their own encrypted column value and write a forged column value of the same byte length back to the datastore. The atom-flood and decompression-bomb payloads are equally viable once forged column bytes reach the decoder. If only authenticated ciphers (AES.GCM or similar) are deployed, the XOR-forgery path is blocked by vault.decrypt!() MAC verification, and exploitation is limited to adversaries with direct raw database write access, bypassing the application entirely. Limiting factors beyond cipher choice include: the attacker's column value must be of the same byte length as the intended forged payload for CTR-mode forgery to work; and the crash is triggered on the next column read, so timing is attacker-controlled but not instant.

The reported CVSS 4.0 score of 5.9 with AV:L models the conservative scenario requiring local or direct database write access, but the description explicitly documents a more accessible attack path: an application-layer user with AES.CTR-encrypted columns can forge ciphertext over the network without key material. AT:P (attack requirements present) correctly captures the conditional dependency on AES.CTR being configured. The impact is exclusively availability (VA:H): a node-wide BEAM crash affecting all tenants sharing the runtime - no confidentiality or integrity impact. EPSS data is not provided in the input; given the specific configuration prerequisite (AES.CTR must be deployed and the attacker must control a column), opportunistic mass exploitation is unlikely, suggesting a lower real-world exploitation probability than an unqualified DoS framing implies. Active exploitation is not confirmed - not in CISA KEV. However, once the attack path is understood, the XOR-forgery step requires only knowledge of one's own plaintext and is computationally trivial. The CVSS PR:N is potentially misleading: writing a forged column value almost certainly requires at minimum application-layer user credentials, suggesting PR:L better reflects real-world conditions. This is a moderate-priority finding for AES.CTR deployments; authenticated-cipher-only deployments face a substantially narrower attack surface.

An authenticated user of an Ash Framework web application reads their own AES.CTR-encrypted column value, XORs the known plaintext against the returned ciphertext to recover the keystream, and constructs a same-length forged ciphertext encoding a compressed ETF decompression bomb. The user writes this forged value back to their own record via a normal application update endpoint. The next time any code path loads that column - by the attacker, an admin, or a background job - AshCloak.Calculations.Decrypt decodes the forged ETF, the BEAM node runs out of memory inflating the bomb, and the entire Elixir application crashes, taking all concurrent users offline. No publicly available exploit code was identified at time of analysis.