CVE-2026-81319: Vulnerability in AshCloak Allows Node DoS via Unsafe Deserialization
Summary
CVE-2026-81319: Unsafe deserialization of decrypted terms enables node DoS in AshCloak. Affects ash_cloak across 2 version ranges.
>= 0.1.0, < 0.4.0
>= f1595a77fdfa9bfc672f84c2f77feb9e7bf895fc, < 1690f0a436efe3e7c11d70d74ff5a8ac0fdf6608
Fixed in 0.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
AshCloak is a library designed for securely managing sensitive data in Elixir applications. It provides functionalities for encrypting and decrypting data, ensuring that sensitive information is protected during storage and transmission. However, a vulnerability exists that allows attackers to exploit the deserialization process of decrypted data, leading to potential denial-of-service (DoS) attacks on the BEAM node.
Vulnerability Detail
The vulnerability arises from the unsafe deserialization of decrypted terms in AshCloak. When an attacker influences the bytes of an encrypted column, it can lead to unbounded atom creation or trigger a decompression bomb during decryption. The method AshCloak.Calculations.Decrypt uses to decode the decrypted binary does not utilize the :safe option, resulting in atoms being interned and never garbage collected. This can exhaust the atom table or inflate compressed payloads to excessive sizes, crashing the BEAM node. The vulnerability affects versions of AshCloak from 0.1.0 up to, but not including, 0.4.0.
How To Fix
Latest published version: 0.4.0 as of 22 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using AshCloak with unauthenticated vault ciphers, such as the AES.CTR cipher provided by Cloak. Ensure that the stored ciphertext cannot be modified by unauthorized users, and avoid reading cloaked fields that trigger the decrypt calculation.
Conclusion
CVE-2026-81319 is a significant vulnerability in the AshCloak library that can lead to denial-of-service attacks through unsafe deserialization. It is crucial for users of the library to update to version 0.4.0 or later to mitigate this risk. Additionally, utilizing Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ash_cloak →
FAQ
CVE-2026-81319 is a vulnerability in the AshCloak library that allows attackers to exploit unsafe deserialization of decrypted data, potentially leading to denial-of-service attacks.
Versions of AshCloak from 0.1.0 to just before 0.4.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without needing to sign up.
The CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
If you cannot update immediately, consider implementing the suggested workaround by avoiding the use of unauthenticated vault ciphers and ensuring that stored ciphertext cannot be modified by unauthorized users.
Related vulnerabilities
Recent vulnerabilities recorded for ash_cloak.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.