Ash Framework
Approved changes feed: RSS · Atom
cpe:2.3:a:ash-hq:ash_framework:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Ash Hq (37829e25-2fd3-55a6-99b9-bfe9008cfd90) |
|---|---|
| Product | Ash Framework (d5f33b9e-602b-5f07-a007-e6e452e7a396) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/ash-project/ash |
purl2cpe | 2026-06-01 10:18:07.639929 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-34593 |
vulnerable | 2026-06-08 07:59:12.734244 |
Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash
Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type.Module.cast_input/2 unconditionally creates a new Erlang atom via Module.concat([value]) for any user-supplied binary string that starts with "Elixir.", before verifying whether the referenced module exists. Because Erlang atoms are never garbage-collected and the BEAM atom table has a hard default limit of approximately 1,048,576 entries, an attacker who can submit values to any resource attribute or argument of type :module can exhaust this table and crash the entire BEAM VM, taking down the application. This issue has been patched in version 3.22.0.
Published: 2026-04-02T17:42:26.459Z
Updated: 2026-04-03T13:04:09.413Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.