TI-2026-07438 Aliases CVE-2026-8469 GHSA-833p-95jq-929q

Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook

HIGH 75CWE-770Published 2026-05-20 · Updated 2026-05-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthenticated denial-of-service via BEAM atom table exhaustion. Multiple LiveView event handlers convert user-supplied event parameter strings to atoms using String.to_atom/1 without validation: 'Elixir.PhoenixStorybook.ExtraAssignsHelpers':handle_set_variation_assign/3 interns every key of the psb-assign params map; 'Elixir.PhoenixStorybook.ExtraAssignsHelpers':handle_toggle_variation_assign/3 interns the "attr" value from psb-toggle events; 'Elixir.PhoenixStorybook.ExtraAssignsHelpers':to_variation_id/2 interns elements of "variation_id"; and 'Elixir.PhoenixStorybook.ExtraAssignsHelpers':to_value/4 interns raw string values for attributes declared as :atom or :boolean. BEAM atoms are never garbage-collected, so each unique attacker-controlled string is a permanent allocation. Once the atom table ceiling (~1,048,576 atoms) is reached, the entire BEAM node aborts, taking down all applications running on it. This issue affects phoenix_storybook from 0.2.0 before 1.1.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00537 45th percentileScored 2026-11-07

Fix Fixed phoenix_storybook (phenixdigital): 1.1.0phoenix_storybook (Hex): 1.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
phenixdigital	phoenix_storybook	0.2.0 to before 1.1.0	1.1.0	Patch available	CNA
—	phoenix_storybook (Hex)	0.2.0 to before 1.1.0	1.1.0	Patch available	GHSA-833p-95jq-929q

phoenix_storybook Vendorphenixdigital Affected 0.2.0 to before 1.1.0 Fixed in 1.1.0 Patch available CNA
phoenix_storybook (Hex) Vendor— Affected 0.2.0 to before 1.1.0 Fixed in 1.1.0 Patch available GHSA-833p-95jq-929q

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:phenixdigital:phoenix_storybook::::::::	—	—	phenixdigital

cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:* Versions — — ·phenixdigital

Remediation

Fix · CNA phoenix_storybook (phenixdigital) Fixed in 1.1.0
Fix · GHSA-833p-95jq-929q phoenix_storybook (Hex) Fixed in 1.1.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-05-20
phenixdigital phoenix_storybook 1.1.0
3 records Highest priority Priority HIGH 2 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2026-07436 Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playgroundPriority HIGH 82
- TI-2026-34670 Cross-session PubSub topic injection via URL parameter in phoenix_storybookPriority MEDIUM 51
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-8469
2026-10-03 Alias added: GHSA-833p-95jq-929q

References

Patch 1

https://github.com/phenixdigital/phoenix_storybook/commit/96d524690af0fe197a49f60d18e564a620b9ef81

Advisory 2

Other 3

TI-2026-07436 Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground CVSS 4.0CRITICAL 9.5
TI-2026-34670 Cross-session PubSub topic injection via URL parameter in phoenix_storybook CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences