CVE-2026-82722
Received Received - Intake

Allocation of Resources Without Limits or Throttling in ash_admin

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: EEF

Description
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node. Two LiveView event handlers interned atoms from unvalidated client input: AshAdmin.PageLive's set_actor built modules from the resource/domain payload with Module.concat/1, and AshAdmin.Components.Resource.Show's calculate converted every submitted form key with String.to_atom/1. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted resource/domain against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned. This issue affects ash_admin: from 0.1.0 before 1.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82722
EUVD
EUVD-2026-68325

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_admin From 0.1.0 (inc) to 1.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82722 is a Denial of Service (DoS) vulnerability in the ash_admin library affecting versions 0.1.0 to 1.3.0. It occurs when two LiveView event handlers intern atoms from unvalidated client input without limits. The 'set_actor' handler in AshAdmin.PageLive and the 'calculate' handler in AshAdmin.Components.Resource.Show convert user-supplied strings into atoms using Module.concat/1 and String.to_atom/1. Since atoms in BEAM are never garbage collected and the atom table has a fixed size, an attacker can repeatedly send requests with random strings to mint new atoms until the VM crashes, taking down all applications on the node.

Detection Guidance

To detect this vulnerability, monitor for excessive atom creation in the BEAM VM. Use Erlang shell commands like 'erlang:memory(atom)' to check atom table usage and 'erlang:system_info(atom_count)' to see the number of atoms. High or rapidly increasing atom counts may indicate exploitation. Also check LiveView event logs for repeated 'set_actor' or 'calculate' events with random keys.

Impact Analysis

This vulnerability can crash the entire BEAM node and all applications running on it by exhausting the atom table. An attacker can exploit it with a single unauthenticated event containing 20,000 unique keys, creating over 20,000 new atoms. The impact is severe due to the high availability impact and low attack complexity, requiring no privileges.

Compliance Impact

This vulnerability primarily impacts availability by enabling denial-of-service attacks that crash the entire BEAM node. While not directly violating GDPR or HIPAA, such outages could disrupt access to personal data or protected health information, potentially leading to compliance failures related to data accessibility and system reliability requirements.

Mitigation Strategies

Immediately upgrade ash_admin to version 1.3.1 or later. If upgrading is not possible, restrict access to the admin LiveView endpoints by network controls or authentication. Monitor system logs for unusual atom table growth and block requests with excessive or random form keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82722. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart