CVE-2026-82722 in ash_admin
Summary
by MITRE • 08/31/2026
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node.
Two LiveView event handlers interned atoms from unvalidated client input: AshAdmin.PageLive's set_actor built modules from the resource/domain payload with Module.concat/1, and AshAdmin.Components.Resource.Show's calculate converted every submitted form key with String.to_atom/1. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted resource/domain against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned.
This issue affects ash_admin: from 0.1.0 before 1.3.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified in ash-admin versions prior to 1.3.1 represents a critical resource exhaustion flaw rooted in the improper handling of unvalidated user input within LiveView event handlers. This issue specifically targets the BEAM virtual machine's atom table, which has a hard limit on the number of unique atoms it can hold. In Erlang and Elixir systems, atoms are used to represent identifiers such as module names, function names, or variables, but unlike other data types in these languages, atoms are never garbage collected once created. This design choice is intended for performance optimization but introduces a significant security risk if user-controlled strings are inadvertently converted into atoms without bounds checking. The vulnerability allows any client with network access to the admin LiveView interface to exhaust this finite resource, leading to a complete denial of service by crashing the entire BEAM node and taking down all applications running on that server instance.
The technical mechanism behind this exploitation involves two specific event handlers within the ash-admin framework: AshAdmin.PageLive's set_actor function and AshAdmin.Components.Resource.Show's calculate handler. The first vulnerability arises from the use of Module.concat/1 to build modules based on resource or domain payloads provided by the client. When user-supplied strings are passed into this function, they can result in the creation of new module names that are interned as atoms within the BEAM atom table. Similarly, the second handler utilizes String.to_atom/1 to convert every submitted form key directly into an atom for processing calculations. Since these inputs originate from external clients and were not validated against a whitelist or restricted set of known values, attackers can flood these endpoints with random, unique strings in rapid succession. Each request generates new atoms that persist indefinitely due to the non-garbage-collected nature of the BEAM runtime environment.
The operational impact of this vulnerability is severe and immediate. As an attacker sends requests containing distinct arbitrary strings, the atom table fills up rapidly. Once the limit imposed by the virtual machine is reached, typically around one million atoms depending on configuration, the BEAM node aborts with a badarg error or similar termination signal. This results in a total service outage for all services hosted on that specific node, not just the ash-admin application itself. Because this affects the core runtime environment rather than an isolated process, recovery requires restarting the entire server instance, leading to significant downtime and potential data loss if stateful processes are abruptly terminated without proper cleanup procedures. This aligns with CWE-770: Allocation of Resources Without Limits or Throttling, as well as CWE-1321: Improperly Controlled Modification of Object Model Attributes, highlighting the failure to restrict resource consumption based on untrusted input.
Mitigation for this vulnerability requires strict validation and sanitization of all user-supplied data before it is processed in a way that could generate new atoms. The fix implemented in ash-admin version 1.3.1 addresses these issues by resolving submitted resources and domains against a known list of valid entities, ensuring that only pre-approved identifiers are used for module construction or key mapping. For the calculate handler, form keys are mapped to declared arguments rather than being directly converted into atoms using String.to_atom/1. Organizations running affected versions must upgrade immediately to version 1.3.1 or later. Additionally, defensive coding practices should be adopted across all Elixir and Erlang applications by avoiding functions like String.to_atom/1 with external input; instead, developers should use safe alternatives such as String.to_existing_atom/1 which raises an error if the atom does not already exist, thereby preventing table exhaustion from new entries. Monitoring tools should also be configured to alert on high rates of node restarts or memory spikes associated with the atom table size to detect potential exploitation attempts in real-time.