CVE-2026-74837 (GCVE-0-2026-74837)
Vulnerability from cvelistv5 – Published: 2026-09-01 02:09 – Updated: 2026-09-01 15:13
VLAI
EPSS
VEX
Title
Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter
Summary
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names.
AshTypescript.FieldFormatter.convert_to_field_atom/2 in lib/ash_typescript/field_formatter.ex converts a client-supplied field name to an atom with String.to_atom/1 when no matching atom already exists. It delegates first to parse_input_field/2, which resolves the name with String.to_existing_atom/1 and falls back to returning the plain string; convert_to_field_atom/2 then mints an atom from that string rather than treating the name as unknown.
RPC field selection reaches it for every requested field name through AshTypescript.Rpc.FieldProcessing.FieldSelector, which resolves each name before checking that the field exists, with no allowlist, length bound, or rate limit. Atoms are never garbage collected, so each distinct name mints a permanent one and the VM aborts once the atom table limit is reached. A field name over 255 characters additionally raises an uncaught SystemLimitError.
This issue affects ash_typescript: from 0.1.0 before 0.18.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:12 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_typescript/sec… | relatedvendor-advisory |
| https://cna.erlef.org/cves/CVE-2026-74837.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-74837 | related |
| https://github.com/ash-project/ash_typescript/com… | patch |
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| ash-project | ash_typescript |
Affected:
0.1.0 , < 0.18.0
(semver)
cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:* |
||
| ash-project | ash_typescript |
Affected:
1a3d4c343430c8e4784acfcd33122a807fafa086 , < df95df4b9afdca5e5bbce32dbd566ccc49a7f14b
(git)
cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74837",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:12:43.897916Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:13:07.724Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-mhxc-mhqx-3v28"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshTypescript.FieldFormatter\u0027",
"\u0027Elixir.AshTypescript.Rpc\u0027",
"\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027"
],
"packageName": "ash_typescript",
"packageURL": "pkg:hex/ash_typescript",
"product": "ash_typescript",
"programFiles": [
"lib/ash_typescript/field_formatter.ex",
"lib/ash_typescript/rpc.ex",
"lib/ash_typescript/rpc/field_processing/field_selector.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshTypescript.FieldFormatter\u0027:convert_to_field_atom/2"
},
{
"name": "\u0027Elixir.AshTypescript.FieldFormatter\u0027:parse_input_field/2"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3"
}
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.18.0",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshTypescript.FieldFormatter\u0027",
"\u0027Elixir.AshTypescript.Rpc\u0027",
"\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027"
],
"packageName": "ash-project/ash_typescript",
"packageURL": "pkg:github/ash-project/ash_typescript",
"product": "ash_typescript",
"programFiles": [
"lib/ash_typescript/field_formatter.ex",
"lib/ash_typescript/rpc.ex",
"lib/ash_typescript/rpc/field_processing/field_selector.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshTypescript.FieldFormatter\u0027:convert_to_field_atom/2"
},
{
"name": "\u0027Elixir.AshTypescript.FieldFormatter\u0027:parse_input_field/2"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3"
}
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"versions": [
{
"lessThan": "df95df4b9afdca5e5bbce32dbd566ccc49a7f14b",
"status": "affected",
"version": "1a3d4c343430c8e4784acfcd33122a807fafa086",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application exposes an AshTypescript RPC endpoint over HTTP, so that client-supplied field names reach \u003ccode\u003eAshTypescript.Rpc.run_action/3\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application exposes an AshTypescript RPC endpoint over HTTP, so that client-supplied field names reach `AshTypescript.Rpc.run_action/3`."
}
],
"value": "The application exposes an AshTypescript RPC endpoint over HTTP, so that client-supplied field names reach AshTypescript.Rpc.run_action/3."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.18.0",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Torkild Gundersen Kjevik / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshTypescript.FieldFormatter.convert_to_field_atom/2\u003c/code\u003e in \u003ccode\u003elib/ash_typescript/field_formatter.ex\u003c/code\u003e converts a client-supplied field name to an atom with \u003ccode\u003eString.to_atom/1\u003c/code\u003e when no matching atom already exists. It delegates first to \u003ccode\u003eparse_input_field/2\u003c/code\u003e, which resolves the name with \u003ccode\u003eString.to_existing_atom/1\u003c/code\u003e and falls back to returning the plain string; \u003ccode\u003econvert_to_field_atom/2\u003c/code\u003e then mints an atom from that string rather than treating the name as unknown.\u003c/p\u003e\n\u003cp\u003eRPC field selection reaches it for every requested field name through \u003ccode\u003eAshTypescript.Rpc.FieldProcessing.FieldSelector\u003c/code\u003e, which resolves each name before checking that the field exists, with no allowlist, length bound, or rate limit. Atoms are never garbage collected, so each distinct name mints a permanent one and the VM aborts once the atom table limit is reached. A field name over 255 characters additionally raises an uncaught \u003ccode\u003eSystemLimitError\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_typescript: from 0.1.0 before 0.18.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names.\n\n`AshTypescript.FieldFormatter.convert_to_field_atom/2` in `lib/ash_typescript/field_formatter.ex` converts a client-supplied field name to an atom with `String.to_atom/1` when no matching atom already exists. It delegates first to `parse_input_field/2`, which resolves the name with `String.to_existing_atom/1` and falls back to returning the plain string; `convert_to_field_atom/2` then mints an atom from that string rather than treating the name as unknown.\n\nRPC field selection reaches it for every requested field name through `AshTypescript.Rpc.FieldProcessing.FieldSelector`, which resolves each name before checking that the field exists, with no allowlist, length bound, or rate limit. Atoms are never garbage collected, so each distinct name mints a permanent one and the VM aborts once the atom table limit is reached. A field name over 255 characters additionally raises an uncaught `SystemLimitError`.\n\nThis issue affects ash_typescript: from 0.1.0 before 0.18.0."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names.\n\nAshTypescript.FieldFormatter.convert_to_field_atom/2 in lib/ash_typescript/field_formatter.ex converts a client-supplied field name to an atom with String.to_atom/1 when no matching atom already exists. It delegates first to parse_input_field/2, which resolves the name with String.to_existing_atom/1 and falls back to returning the plain string; convert_to_field_atom/2 then mints an atom from that string rather than treating the name as unknown.\n\nRPC field selection reaches it for every requested field name through AshTypescript.Rpc.FieldProcessing.FieldSelector, which resolves each name before checking that the field exists, with no allowlist, length bound, or rate limit. Atoms are never garbage collected, so each distinct name mints a permanent one and the VM aborts once the atom table limit is reached. A field name over 255 characters additionally raises an uncaught SystemLimitError.\n\nThis issue affects ash_typescript: from 0.1.0 before 0.18.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T02:09:30.790Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-mhxc-mhqx-3v28"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-74837.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-74837"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_typescript/commit/df95df4b9afdca5e5bbce32dbd566ccc49a7f14b"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-74837",
"datePublished": "2026-09-01T02:09:30.790Z",
"dateReserved": "2026-08-30T17:30:01.398Z",
"dateUpdated": "2026-09-01T15:13:07.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74837",
"date": "2026-09-01",
"epss": "0.00315",
"percentile": "0.23828"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-74837\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-09-01T03:16:51.187\",\"lastModified\":\"2026-09-01T16:17:17.047\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names.\\n\\nAshTypescript.FieldFormatter.convert_to_field_atom/2 in lib/ash_typescript/field_formatter.ex converts a client-supplied field name to an atom with String.to_atom/1 when no matching atom already exists. It delegates first to parse_input_field/2, which resolves the name with String.to_existing_atom/1 and falls back to returning the plain string; convert_to_field_atom/2 then mints an atom from that string rather than treating the name as unknown.\\n\\nRPC field selection reaches it for every requested field name through AshTypescript.Rpc.FieldProcessing.FieldSelector, which resolves each name before checking that the field exists, with no allowlist, length bound, or rate limit. Atoms are never garbage collected, so each distinct name mints a permanent one and the VM aborts once the atom table limit is reached. A field name over 255 characters additionally raises an uncaught SystemLimitError.\\n\\nThis issue affects ash_typescript: from 0.1.0 before 0.18.0.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"ash-project\",\"product\":\"ash_typescript\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"ash_typescript\",\"cpes\":[\"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.AshTypescript.FieldFormatter\u0027\",\"\u0027Elixir.AshTypescript.Rpc\u0027\",\"\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027\"],\"programFiles\":[\"lib/ash_typescript/field_formatter.ex\",\"lib/ash_typescript/rpc.ex\",\"lib/ash_typescript/rpc/field_processing/field_selector.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.AshTypescript.FieldFormatter\u0027:convert_to_field_atom/2\"},{\"name\":\"\u0027Elixir.AshTypescript.FieldFormatter\u0027:parse_input_field/2\"},{\"name\":\"\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3\"}],\"repo\":\"https://github.com/ash-project/ash_typescript\",\"packageURL\":\"pkg:hex/ash_typescript\",\"versions\":[{\"version\":\"0.1.0\",\"lessThan\":\"0.18.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"ash-project\",\"product\":\"ash_typescript\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"ash-project/ash_typescript\",\"cpes\":[\"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.AshTypescript.FieldFormatter\u0027\",\"\u0027Elixir.AshTypescript.Rpc\u0027\",\"\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027\"],\"programFiles\":[\"lib/ash_typescript/field_formatter.ex\",\"lib/ash_typescript/rpc.ex\",\"lib/ash_typescript/rpc/field_processing/field_selector.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.AshTypescript.FieldFormatter\u0027:convert_to_field_atom/2\"},{\"name\":\"\u0027Elixir.AshTypescript.FieldFormatter\u0027:parse_input_field/2\"},{\"name\":\"\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3\"}],\"repo\":\"https://github.com/ash-project/ash_typescript\",\"packageURL\":\"pkg:github/ash-project/ash_typescript\",\"versions\":[{\"version\":\"1a3d4c343430c8e4784acfcd33122a807fafa086\",\"lessThan\":\"df95df4b9afdca5e5bbce32dbd566ccc49a7f14b\",\"versionType\":\"git\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-01T15:12:43.897916Z\",\"id\":\"CVE-2026-74837\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-74837.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash_typescript/commit/df95df4b9afdca5e5bbce32dbd566ccc49a7f14b\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash_typescript/security/advisories/GHSA-mhxc-mhqx-3v28\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-74837\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash_typescript/security/advisories/GHSA-mhxc-mhqx-3v28\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-74837\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-01T15:12:43.897916Z\"}}}], \"references\": [{\"url\": \"https://github.com/ash-project/ash_typescript/security/advisories/GHSA-mhxc-mhqx-3v28\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-01T15:13:03.459Z\"}}], \"cna\": {\"title\": \"Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Torkild Gundersen Kjevik / Ash Project\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-130\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-130 Excessive Allocation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.7, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ash-project/ash_typescript\", \"vendor\": \"ash-project\", \"modules\": [\"\u0027Elixir.AshTypescript.FieldFormatter\u0027\", \"\u0027Elixir.AshTypescript.Rpc\u0027\", \"\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027\"], \"product\": \"ash_typescript\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.1.0\", \"lessThan\": \"0.18.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/ash_typescript\", \"packageName\": \"ash_typescript\", \"programFiles\": [\"lib/ash_typescript/field_formatter.ex\", \"lib/ash_typescript/rpc.ex\", \"lib/ash_typescript/rpc/field_processing/field_selector.ex\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.AshTypescript.FieldFormatter\u0027:convert_to_field_atom/2\"}, {\"name\": \"\u0027Elixir.AshTypescript.FieldFormatter\u0027:parse_input_field/2\"}, {\"name\": \"\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3\"}]}, {\"cpes\": [\"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ash-project/ash_typescript\", \"vendor\": \"ash-project\", \"modules\": [\"\u0027Elixir.AshTypescript.FieldFormatter\u0027\", \"\u0027Elixir.AshTypescript.Rpc\u0027\", \"\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027\"], \"product\": \"ash_typescript\", \"versions\": [{\"status\": \"affected\", \"version\": \"1a3d4c343430c8e4784acfcd33122a807fafa086\", \"lessThan\": \"df95df4b9afdca5e5bbce32dbd566ccc49a7f14b\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/ash-project/ash_typescript\", \"packageName\": \"ash-project/ash_typescript\", \"programFiles\": [\"lib/ash_typescript/field_formatter.ex\", \"lib/ash_typescript/rpc.ex\", \"lib/ash_typescript/rpc/field_processing/field_selector.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.AshTypescript.FieldFormatter\u0027:convert_to_field_atom/2\"}, {\"name\": \"\u0027Elixir.AshTypescript.FieldFormatter\u0027:parse_input_field/2\"}, {\"name\": \"\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3\"}]}], \"references\": [{\"url\": \"https://github.com/ash-project/ash_typescript/security/advisories/GHSA-mhxc-mhqx-3v28\", \"tags\": [\"related\", \"vendor-advisory\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-74837.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-74837\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/ash-project/ash_typescript/commit/df95df4b9afdca5e5bbce32dbd566ccc49a7f14b\", \"tags\": [\"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names.\\n\\nAshTypescript.FieldFormatter.convert_to_field_atom/2 in lib/ash_typescript/field_formatter.ex converts a client-supplied field name to an atom with String.to_atom/1 when no matching atom already exists. It delegates first to parse_input_field/2, which resolves the name with String.to_existing_atom/1 and falls back to returning the plain string; convert_to_field_atom/2 then mints an atom from that string rather than treating the name as unknown.\\n\\nRPC field selection reaches it for every requested field name through AshTypescript.Rpc.FieldProcessing.FieldSelector, which resolves each name before checking that the field exists, with no allowlist, length bound, or rate limit. Atoms are never garbage collected, so each distinct name mints a permanent one and the VM aborts once the atom table limit is reached. A field name over 255 characters additionally raises an uncaught SystemLimitError.\\n\\nThis issue affects ash_typescript: from 0.1.0 before 0.18.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names.\u003c/p\u003e\\n\u003cp\u003e\u003ccode\u003eAshTypescript.FieldFormatter.convert_to_field_atom/2\u003c/code\u003e in \u003ccode\u003elib/ash_typescript/field_formatter.ex\u003c/code\u003e converts a client-supplied field name to an atom with \u003ccode\u003eString.to_atom/1\u003c/code\u003e when no matching atom already exists. It delegates first to \u003ccode\u003eparse_input_field/2\u003c/code\u003e, which resolves the name with \u003ccode\u003eString.to_existing_atom/1\u003c/code\u003e and falls back to returning the plain string; \u003ccode\u003econvert_to_field_atom/2\u003c/code\u003e then mints an atom from that string rather than treating the name as unknown.\u003c/p\u003e\\n\u003cp\u003eRPC field selection reaches it for every requested field name through \u003ccode\u003eAshTypescript.Rpc.FieldProcessing.FieldSelector\u003c/code\u003e, which resolves each name before checking that the field exists, with no allowlist, length bound, or rate limit. Atoms are never garbage collected, so each distinct name mints a permanent one and the VM aborts once the atom table limit is reached. A field name over 255 characters additionally raises an uncaught \u003ccode\u003eSystemLimitError\u003c/code\u003e.\u003c/p\u003e\\n\u003cp\u003eThis issue affects ash_typescript: from 0.1.0 before 0.18.0.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names.\\n\\n`AshTypescript.FieldFormatter.convert_to_field_atom/2` in `lib/ash_typescript/field_formatter.ex` converts a client-supplied field name to an atom with `String.to_atom/1` when no matching atom already exists. It delegates first to `parse_input_field/2`, which resolves the name with `String.to_existing_atom/1` and falls back to returning the plain string; `convert_to_field_atom/2` then mints an atom from that string rather than treating the name as unknown.\\n\\nRPC field selection reaches it for every requested field name through `AshTypescript.Rpc.FieldProcessing.FieldSelector`, which resolves each name before checking that the field exists, with no allowlist, length bound, or rate limit. Atoms are never garbage collected, so each distinct name mints a permanent one and the VM aborts once the atom table limit is reached. A field name over 255 characters additionally raises an uncaught `SystemLimitError`.\\n\\nThis issue affects ash_typescript: from 0.1.0 before 0.18.0.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of Resources Without Limits or Throttling\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"The application exposes an AshTypescript RPC endpoint over HTTP, so that client-supplied field names reach AshTypescript.Rpc.run_action/3.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe application exposes an AshTypescript RPC endpoint over HTTP, so that client-supplied field names reach \u003ccode\u003eAshTypescript.Rpc.run_action/3\u003c/code\u003e.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"The application exposes an AshTypescript RPC endpoint over HTTP, so that client-supplied field names reach `AshTypescript.Rpc.run_action/3`.\", \"base64\": false}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"0.18.0\", \"versionStartIncluding\": \"0.1.0\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-09-01T02:09:30.790Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-74837\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-01T15:13:07.724Z\", \"dateReserved\": \"2026-08-30T17:30:01.398Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-09-01T02:09:30.790Z\", \"assignerShortName\": \"EEF\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…