CVE-2026-82722: AshAdmin LiveView Atom Table Exhaustion Vulnerability
Summary
CVE-2026-82722: AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS). Affects ash_admin across 2 version ranges.
>= 0.1.0, < 1.3.1
>= 98b03baa8422b94dd13e305bf08b8ee3f7232c7b, < 731dffa09416d68f4ad3a0b6ee146b285ca0083b
Fixed in 1.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshAdmin is a web-based administrative interface for the Ash framework, designed to facilitate the management of resources and domains in applications built with Ash. It leverages LiveView technology to provide real-time updates and interactions. However, it has a critical vulnerability that allows unvalidated client input to exhaust the BEAM atom table, leading to potential denial of service (DoS) for the entire node.
Vulnerability Detail
The vulnerability arises from the allocation of resources without limits or throttling in AshAdmin. Specifically, two LiveView event handlers, set_actor and calculate, intern atoms from unvalidated client input. This means that any client with access to the admin LiveView can flood the system with random names, creating new atoms for each request. Since atoms are never garbage collected and the atom table has a fixed size, this can lead to the exhaustion of the atom table, causing the Erlang VM to abort and crash the entire node, affecting all applications running on it.
How To Fix
Latest published version: 1.3.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the admin LiveView to trusted users only, thereby minimizing the risk of exploitation until the package is updated. Additionally, consider implementing rate limiting on the LiveView event handlers to mitigate the impact of potential flooding.
Conclusion
CVE-2026-82722 represents a significant risk for applications using AshAdmin, allowing for potential denial of service through atom table exhaustion. It is crucial to update to the patched version and implement recommended security measures to protect your application.
See every vulnerability recorded for ash_admin →
FAQ
CVE-2026-82722 is a vulnerability in the AshAdmin package that allows clients to exhaust the BEAM atom table through unvalidated input, potentially leading to a denial of service.
If your application uses AshAdmin and is running a vulnerable version, it could be susceptible to denial of service attacks, causing the entire node to crash.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.3, indicating a high severity level.
Update the AshAdmin package to version 1.3.1 or later and consider implementing access restrictions and rate limiting as temporary measures.
Related vulnerabilities
Recent vulnerabilities recorded for ash_admin.
