CVE-2026-81319 (GCVE-0-2026-81319)
Vulnerability from cvelistv5
Published
2026-08-30 18:05
Modified
2026-08-30 18:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-502 - Deserialization of Untrusted Data
Summary
Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption.
AshCloak.Calculations.Decrypt decodes the decrypted binary with Ash.Helpers.non_executable_binary_to_term/1 without the :safe option, so atoms in the payload are interned during the decode and never garbage collected, and the term format's compressed form is inflated transparently. vault.decrypt!() is the only barrier and stops tampering only for an authenticated cipher. Cloak also ships the unauthenticated AES.CTR, whose ciphertext an attacker who knows their own plaintext can XOR into any same-length payload without the key, so an ordinary read of the forged column reaches the decoder. A few hundred kilobytes of distinct atoms exhausts the atom table, or a small compressed payload inflates to gigabytes.
This issue affects ash_cloak: from 0.1.0 before 0.4.0.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ash-project | ash_cloak |
Version: 0.1.0 ≤ cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:* |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshCloak.Calculations.Decrypt\u0027"
],
"packageName": "ash_cloak",
"packageURL": "pkg:hex/ash_cloak",
"product": "ash_cloak",
"programFiles": [
"lib/ash_cloak/calculations/decrypt.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshCloak.Calculations.Decrypt\u0027:calculate/3"
}
],
"repo": "https://github.com/ash-project/ash_cloak",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.4.0",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshCloak.Calculations.Decrypt\u0027"
],
"packageName": "ash-project/ash_cloak",
"packageURL": "pkg:github/ash-project/ash_cloak",
"product": "ash_cloak",
"programFiles": [
"lib/ash_cloak/calculations/decrypt.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshCloak.Calculations.Decrypt\u0027:calculate/3"
}
],
"repo": "https://github.com/ash-project/ash_cloak",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1690f0a436efe3e7c11d70d74ff5a8ac0fdf6608",
"status": "affected",
"version": "f1595a77fdfa9bfc672f84c2f77feb9e7bf895fc",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn application must use ash_cloak with an unauthenticated vault cipher (for example the \u003ccode\u003eAES.CTR\u003c/code\u003e cipher shipped by Cloak), or run in a deployment where the stored ciphertext can be modified, and read a cloaked field so the decrypt calculation runs.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An application must use ash_cloak with an unauthenticated vault cipher (for example the `AES.CTR` cipher shipped by Cloak), or run in a deployment where the stored ciphertext can be modified, and read a cloaked field so the decrypt calculation runs."
}
],
"value": "An application must use ash_cloak with an unauthenticated vault cipher (for example the AES.CTR cipher shipped by Cloak), or run in a deployment where the stored ciphertext can be modified, and read a cloaked field so the decrypt calculation runs."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.4.0",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDeserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshCloak.Calculations.Decrypt\u003c/code\u003e decodes the decrypted binary with \u003ccode\u003eAsh.Helpers.non_executable_binary_to_term/1\u003c/code\u003e without the \u003ccode\u003e:safe\u003c/code\u003e option, so atoms in the payload are interned during the decode and never garbage collected, and the term format\u0027s compressed form is inflated transparently. \u003ccode\u003evault.decrypt!()\u003c/code\u003e is the only barrier and stops tampering only for an authenticated cipher. Cloak also ships the unauthenticated \u003ccode\u003eAES.CTR\u003c/code\u003e, whose ciphertext an attacker who knows their own plaintext can XOR into any same-length payload without the key, so an ordinary read of the forged column reaches the decoder. A few hundred kilobytes of distinct atoms exhausts the atom table, or a small compressed payload inflates to gigabytes.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_cloak: from 0.1.0 before 0.4.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption.\n\n`AshCloak.Calculations.Decrypt` decodes the decrypted binary with `Ash.Helpers.non_executable_binary_to_term/1` without the `:safe` option, so atoms in the payload are interned during the decode and never garbage collected, and the term format\u0027s compressed form is inflated transparently. `vault.decrypt!()` is the only barrier and stops tampering only for an authenticated cipher. Cloak also ships the unauthenticated `AES.CTR`, whose ciphertext an attacker who knows their own plaintext can XOR into any same-length payload without the key, so an ordinary read of the forged column reaches the decoder. A few hundred kilobytes of distinct atoms exhausts the atom table, or a small compressed payload inflates to gigabytes.\n\nThis issue affects ash_cloak: from 0.1.0 before 0.4.0."
}
],
"value": "Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption.\n\nAshCloak.Calculations.Decrypt decodes the decrypted binary with Ash.Helpers.non_executable_binary_to_term/1 without the :safe option, so atoms in the payload are interned during the decode and never garbage collected, and the term format\u0027s compressed form is inflated transparently. vault.decrypt!() is the only barrier and stops tampering only for an authenticated cipher. Cloak also ships the unauthenticated AES.CTR, whose ciphertext an attacker who knows their own plaintext can XOR into any same-length payload without the key, so an ordinary read of the forged column reaches the decoder. A few hundred kilobytes of distinct atoms exhausts the atom table, or a small compressed payload inflates to gigabytes.\n\nThis issue affects ash_cloak: from 0.1.0 before 0.4.0."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-30T18:05:13.889Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_cloak/security/advisories/GHSA-rc26-mrm2-6pf9"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-81319.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-81319"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_cloak/commit/1690f0a436efe3e7c11d70d74ff5a8ac0fdf6608"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unsafe deserialization of decrypted terms enables node DoS in AshCloak"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-81319",
"datePublished": "2026-08-30T18:05:13.889Z",
"dateReserved": "2026-08-30T05:45:01.821Z",
"dateUpdated": "2026-08-30T18:05:13.889Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…