CVE-2026-74837Patch

🚨 [UNAUTHENTICATED DoS] — A NEW ASHTYPESCRIPT FLAW LETS REMOTE ATTACKERS PERMANENTLY FILL THE BEAM VM'S ATOM TABLE UNTIL THE ENTIRE NODE ABORTS CVE-2026-74837 scores 8.7/10. The vulnerable RPC field-selection logic creates permanent Erlang/Elixir atoms from attacker-controlled field names BEFORE verifying whether those fields even exist. CyberSignal Priority: 🔴 HIGH 📅 Published: September 1, 2026 🆔 CVE-2026-74837 ⚠️ CVSS 4.0: 8.7 HIGH 🎯 ash-project / ash_typescript 🛠️ Fixed: 0.18.0 🏷️ Elixir · BEAM · DoS · API Security · Resource Exhaustion This vulnerability abuses something unusual about the Erlang/Elixir runtime: ### **atoms are not garbage collected.** Create enough of them— and eventually: **the VM dies.** ### 🔎 What happened A newly published vulnerability affects: `ash_typescript` before: **0.18.0.** The vulnerable component processes field names supplied through: AshTypescript RPC endpoints. The problem exists in: `AshTypescript.FieldFormatter.convert_to_field_atom/2`. When a client supplies a field name that does not already correspond to an existing atom, the implementation can eventually call: `http://String.to_atom/1` on the attacker-controlled string. That creates a new: ### BEAM atom. The application performs this conversion BEFORE sufficiently validating that the requested field actually exists. ### ⚔️ Attack chain Internet/API client ↓ Sends RPC request ↓ Request contains unique fake field name ↓ AshTypescript processes field selection ↓ No matching existing atom found ↓ `http://String.to_atom()` creates new atom ↓ Attacker repeats with another unique name ↓ Another permanent atom created ↓ Again ↓ Again ↓ Atom table fills ↓ BEAM VM reaches atom-table limit ↓ ### Node aborts. No authentication: **required.** No user interaction: **required.** Attack complexity: **LOW.** ### 🧠 Why atoms are different In Erlang and Elixir: atoms are commonly used for fixed identifiers such as: `:ok` `:error` `:admin` `:email`. They are intentionally efficient. But they have an important property: ### atoms persist for the life of the VM. They are not handled like normal temporary strings. If an application does this: User input ↓ `http://String.to_atom(user_input)` an attacker may continuously create: `:aaaa1` `:aaaa2` `:aaaa3` `:aaaa4` ... Each new value consumes another atom-table entry. The memory may be small per entry. But the number of entries is: **finite.** Once the table is exhausted: the BEAM VM can terminate. ### 💥 There's another crash path The advisory also notes that attacker-controlled field names longer than: **255 characters** can trigger an uncaught: `SystemLimitError`. So defenders face two resource-abuse paths: many unique field names → atom-table exhaustion OR oversized field name → unhandled runtime error. ### 🎯 What is affected Affected: `ash_typescript` from: **0.1.0** through versions before: ### **0.18.0.** The vulnerable path matters when applications expose: AshTypescript RPC functionality over HTTP such that: client-controlled field names reach: `http://AshTypescript.Rpc.run_action/3`. Not every Elixir application is affected. This is specific to applications using the vulnerable: ash_typescript functionality. ### 🧠 Why this matters This is a good example of how language/runtime semantics become: security boundaries. In another runtime: arbitrarily creating strings might mostly create: memory pressure. In BEAM: dynamically creating atoms from arbitrary external input has historically been considered dangerous because: ### atoms are permanent. The secure pattern is usually: `http://String.to_existing_atom()` or an explicit: allowlist/map when converting untrusted input. ### ⚠️ Important caveat This is NOT: remote code execution. The primary security impact is: ### availability. Successful exploitation can crash the vulnerable node. There is also currently no verified evidence of: active exploitation in the wild. CISA KEV: ❌ not listed. The severity comes from the combination: network accessible + unauthenticated + low complexity + potential complete service termination. ### 🛡️ Defender action If your environment uses: `ash_typescript` upgrade to: ### **0.18.0 or later.** Also review APIs for unsafe patterns involving: `http://String.to_atom(untrusted_input)`. Defensive pattern: external string ↓ validate against expected fields ↓ map to existing atom ↓ reject unknown value. NOT: external string ↓ create new atom ↓ check later. Add: API rate limits ↓ field-name length limits ↓ schema validation ↓ process/node restart monitoring. Security teams running Elixir applications should also alert on: unexpected BEAM node restarts and: repeated malformed RPC field requests. ### 🧠 CyberSignal insight **Sometimes the vulnerability isn't memory corruption — it's misunderstanding the language runtime. In BEAM, turning unlimited attacker-controlled strings into permanent atoms can turn an ordinary API request into a kill switch.** Sources: Erlang Ecosystem Foundation CNA · CVE-2026-74837 · ash-project security advisory