CVE-2026-81319
Received Received - Intake

Deserialization Flaw in AshCloak Allows DoS via Atom Bombing

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: EEF

Description
Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypted binary with Ash.Helpers.non_executable_binary_to_term/1 without the :safe option, so atoms in the payload are interned during the decode and never garbage collected, and the term format's compressed form is inflated transparently. vault.decrypt!() is the only barrier and stops tampering only for an authenticated cipher. Cloak also ships the unauthenticated AES.CTR, whose ciphertext an attacker who knows their own plaintext can XOR into any same-length payload without the key, so an ordinary read of the forged column reaches the decoder. A few hundred kilobytes of distinct atoms exhausts the atom table, or a small compressed payload inflates to gigabytes. This issue affects ash_cloak: from 0.1.0 before 0.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-81319
EUVD
EUVD-2026-68281

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_cloak From 0.1.0 (inc) to 0.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a deserialization of untrusted data issue in the ash_cloak library. It allows an attacker who can manipulate encrypted column data to crash the BEAM node by triggering unbounded atom creation or a decompression bomb during decryption. The AshCloak.Calculations.Decrypt function uses unsafe deserialization without the :safe option, causing atoms in the payload to be interned and never garbage collected. Additionally, compressed payloads can inflate transparently, leading to resource exhaustion.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of ash_cloak (0.1.0 to 0.4.0) and inspecting decryption processes for unsafe deserialization. Look for applications using unauthenticated vault ciphers like AES.CTR. Check logs for crashes or high memory usage during decryption.

Impact Analysis

This vulnerability can lead to denial-of-service (DoS) attacks on your BEAM node. An attacker can crash the node by exhausting the atom table with a few hundred kilobytes of distinct atoms or by inflating a small compressed payload to gigabytes. This impacts system availability and may require restarting the node to recover.

Compliance Impact

This vulnerability primarily impacts system availability by enabling denial-of-service attacks through atom table exhaustion or decompression bombs. While not directly violating GDPR or HIPAA, it could lead to service disruptions affecting data access or processing, potentially violating availability requirements in these regulations.

Mitigation Strategies
  • Upgrade ash_cloak to version 0.4.0 or later to apply the security fix.
  • Replace unauthenticated ciphers like AES.CTR with authenticated ones such as AES.GCM.
  • Ensure decryption uses safe deserialization with the :safe option to prevent atom creation.
  • Audit and restrict access to encrypted columns to prevent tampering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81319. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart