CVE-2026-94201: Ash Package Atom Table Exhaustion Vulnerability
Summary
CVE-2026-94201: Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash. Affects ash across 2 version ranges.
>= 3.5.1, < 3.34.3
>= 2970ba3bd5d36d6ad04c731ac87385375d457147, < 5282f3f513053628cdd1bf2236ea22d975d934d4
Fixed in 3.34.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ash is an open-source framework designed for building APIs in Elixir. It allows developers to define resources, actions, and queries in a structured manner. One of its key features is the ability to filter attributes, including those of type :atom. However, certain configurations can expose the application to vulnerabilities, particularly when using the 'unsafe_to_atom?' constraint.
Vulnerability Detail
The vulnerability arises from the handling of :atom attributes in Ash when filtering. When an attribute is defined with 'unsafe_to_atom?: true', any string provided by an attacker can be coerced into an atom using String.to_atom/1. This leads to the creation of new atoms for each unique string, which are never garbage collected. As a result, an attacker can exhaust the BEAM atom table, causing a denial of service by crashing the node. This issue affects versions of Ash from 3.5.1 to 3.34.3, particularly when public filterable :atom attributes are exposed.
How To Fix
Latest published version: 3.37.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.34.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'unsafe_to_atom?: true' constraint for public, filterable :atom attributes. Instead, consider using string types for attributes that may be exposed to user input.
Conclusion
CVE-2026-94201 is a significant vulnerability in the Ash framework that can lead to denial of service through atom table exhaustion. It is crucial for developers using affected versions to update to the patched version and consider the implications of using 'unsafe_to_atom?' in their applications.
See every vulnerability recorded for ash →
FAQ
CVE-2026-94201 is a vulnerability in the Ash framework that allows attackers to exhaust the BEAM atom table through improper handling of :atom attributes.
If your application exposes public filterable :atom attributes with 'unsafe_to_atom?: true', it may be susceptible to denial of service attacks.
The vulnerability affects Ash versions from 3.5.1 to 3.34.3.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for CVE-2026-94201 is 8.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ash.
