ash-project ash_admin up to 1.3.0 LiveView Event AshAdmin.Components.Resource.Show Module.concat/String.to_atom allocation of resources

Summaryinfo

A vulnerability has been found in ash-project ash_admin up to 1.3.0 and classified as problematic. Affected by this issue is the function Module.concat/String.to_atom of the file AshAdmin.PageLive/AshAdmin.Components.Resource.Show of the component LiveView Event Handler. The manipulation leads to allocation of resources. This vulnerability is documented as CVE-2026-82722. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in ash-project ash_admin up to 1.3.0 and classified as problematic. This issue affects the function Module.concat/String.to_atom of the file AshAdmin.PageLive/AshAdmin.Components.Resource.Show of the component LiveView Event Handler. The manipulation with an unknown input leads to a allocation of resources vulnerability. Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. Impacted is availability. The summary by CVE is:

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node. Two LiveView event handlers interned atoms from unvalidated client input: AshAdmin.PageLive's set_actor built modules from the resource/domain payload with Module.concat/1, and AshAdmin.Components.Resource.Show's calculate converted every submitted form key with String.to_atom/1. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted resource/domain against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned. This issue affects ash_admin: from 0.1.0 before 1.3.1.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-82722 since 08/31/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 1.3.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-68325). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash_admin

Version

• 1.0
• 1.1
• 1.2
• 1.3.0

Website

• Product: https://github.com/ash-project/ash_admin/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion