CVE-2026-81319

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81319
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81319.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81319
Aliases
Published
2026-08-30T18:05:13Z
Modified
2026-09-03T03:30:50Z
Severity
  • 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Unsafe deserialization of decrypted terms enables node DoS in AshCloak
Details

Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption.

AshCloak.Calculations.Decrypt decodes the decrypted binary with Ash.Helpers.non_executable_binary_to_term/1 without the :safe option, so atoms in the payload are interned during the decode and never garbage collected, and the term format's compressed form is inflated transparently. vault.decrypt!() is the only barrier and stops tampering only for an authenticated cipher. Cloak also ships the unauthenticated AES.CTR, whose ciphertext an attacker who knows their own plaintext can XOR into any same-length payload without the key, so an ordinary read of the forged column reaches the decoder. A few hundred kilobytes of distinct atoms exhausts the atom table, or a small compressed payload inflates to gigabytes.

This issue affects ash_cloak: from 0.1.0 before 0.4.0.

Database specific 
{
    "cna_assigner": "EEF",
    "cwe_ids": [
        "CWE-502"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81319.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "f1595a77fdfa9bfc672f84c2f77feb9e7bf895fc"
                },
                {
                    "fixed": "1690f0a436efe3e7c11d70d74ff5a8ac0fdf6608"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/ash-project/ash_cloak

Affected ranges

Type
GIT
Repo
https://github.com/ash-project/ash_cloak
Events
Introduced
848aad4edcae5997784b7dd9f1dd20968ad7aaf3
Fixed
b20fd3056f0161ccd407e9a2e7bdde1aa069c147
Fixed
1690f0a436efe3e7c11d70d74ff5a8ac0fdf6608
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.1.0"
        },
        {
            "fixed": "0.4.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.2.0
v0.2.1
v0.3.0
v0.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81319.json"