TI-2026-67894 Aliases CVE-2026-94201 GHSA-hh99-hqg5-6646

Filtering :atom attributes in Ash can exhaust the BEAM atom table

LOW 35CWE-770Published 2026-10-05 · Updated 2026-10-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

Ash, an Elixir framework, is affected from 3.5.1 before 3.34.3. Filtering on a public :atom attribute declared with unsafe_to_atom?: true converts attacker-supplied filter strings into atoms with String.to_atom/1, which the BEAM never garbage collects. An unauthenticated remote attacker who can supply filter values can exhaust the atom table (CWE-770) and crash the node, causing a denial of service. AshPaperTrail exposes such an attribute by default.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through Ash.Type.Atom. Because the type defined no coerce/2 callback, coercion fell back to the default (cast_input/2), which calls String.to_atom/1 when the attribute is configured with the unsafe_to_atom?: true constraint. Filtering such an attribute with attacker-controlled strings therefore interned a new, permanent atom for every distinct value. Atoms are never garbage collected and the BEAM caps the atom table, so an actor who can supply filter values for a public, filterable :atom attribute declared with unsafe_to_atom?: true can exhaust the atom table and crash the node (denial of service). AshPaperTrail is a notable example: its version resources expose a public, filterable version_action_name atom attribute with unsafe_to_atom?: true by default. The fix adds a coerce/2 to Ash.Type.Atom that never interns atoms — a comparison value is left as a string, since the type is stored and compared as a string. Setting the attribute from action input (cast_input/2, which still honors unsafe_to_atom?) is unchanged. This issue affects ash: from 3.5.1 before 3.34.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00301 23rd percentileScored 2026-11-07

Fix Fixed ash (ash-project): 3.34.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ash-project	ash	3.5.1 to before 3.34.3	3.34.3	Patch available	CNA

ash Vendorash-project Affected 3.5.1 to before 3.34.3 Fixed in 3.34.3 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ash-project:ash::::::::	—	—	—

cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Upgrade ash to version 3.34.3 or later. The sources list no fixed version for AshPaperTrail, and the fix is in ash itself.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA ash (ash-project) Fixed in 3.34.3

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-05 Threatist record created from CVE-2026-94201
2026-10-06 Alias added: GHSA-hh99-hqg5-6646
2026-10-06 Affected versions changed · Red Hat
2026-10-06 CVSS score added · Red Hat
2026-10-06 CISA SSVC decision points changed
2026-10-06 Priority changed: MEDIUM → LOW

References

Patch 1

Fix commit 5282f3f in ash-project/ash

Advisory 1

EEF CNA record for CVE-2026-94201

Other 2

TI-2026-56298 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service CVSS 4.0HIGH 8.7
TI-2026-52572 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter CVSS 4.0HIGH 8.7
TI-2026-57010 Path traversal in AshAdmin file uploads via unsanitized client filename CVSS 4.0HIGH 8.3
TI-2026-26840 Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash CVSS 4.0HIGH 8.2
TI-2026-54252 EEx template evaluation of prompt content in AshAi enables remote code execution CVSS 4.0HIGH 8.9
TI-2026-54208 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content CVSS 4.0HIGH 8.4

See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences