CVE-2026-81319

Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypted binary with Ash.Helpers.non_executable_binary_to_term/1 without the :safe option, so atoms in the payload are interned during the decode and never garbage collected, and the term format's compressed form is inflated transparently. vault.decrypt!() is the only barrier and stops tampering only for an authenticated cipher. Cloak also ships the unauthenticated AES.CTR, whose ciphertext an attacker who knows their own plaintext can XOR into any same-length payload without the key, so an ordinary read of the forged column reaches the decoder. A few hundred kilobytes of distinct atoms exhausts the atom table, or a small compressed payload inflates to gigabytes. This issue affects ash_cloak: from 0.1.0 before 0.4.0.

CVSS

No CVSS.

References

Link	Resource
https://cna.erlef.org/cves/CVE-2026-81319.html
https://github.com/ash-project/ash_cloak/commit/1690f0a436efe3e7c11d70d74ff5a8ac0fdf6608
https://github.com/ash-project/ash_cloak/security/advisories/GHSA-rc26-mrm2-6pf9
https://osv.dev/vulnerability/EEF-CVE-2026-81319
https://github.com/ash-project/ash_cloak/security/advisories/GHSA-rc26-mrm2-6pf9

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-30 18:16

Updated : 2026-09-01 21:15

NVD link : CVE-2026-81319

Mitre link : CVE-2026-81319

CVE.ORG link : CVE-2026-81319

JSON object : View

Products Affected

No product.

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-81319", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-81319", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-01T12:32:22.534417Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "affectedData": [{"cpes": ["cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"], "repo": "https://github.com/ash-project/ash_cloak", "vendor": "ash-project", "modules": ["'Elixir.AshCloak.Calculations.Decrypt'"], "product": "ash_cloak", "versions": [{"status": "affected", "version": "0.1.0", "lessThan": "0.4.0", "versionType": "semver"}], "packageURL": "pkg:hex/ash_cloak", "packageName": "ash_cloak", "programFiles": ["lib/ash_cloak/calculations/decrypt.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.AshCloak.Calculations.Decrypt':calculate/3"}]}, {"cpes": ["cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"], "repo": "https://github.com/ash-project/ash_cloak", "vendor": "ash-project", "modules": ["'Elixir.AshCloak.Calculations.Decrypt'"], "product": "ash_cloak", "versions": [{"status": "affected", "version": "f1595a77fdfa9bfc672f84c2f77feb9e7bf895fc", "lessThan": "1690f0a436efe3e7c11d70d74ff5a8ac0fdf6608", "versionType": "git"}], "packageURL": "pkg:github/ash-project/ash_cloak", "packageName": "ash-project/ash_cloak", "programFiles": ["lib/ash_cloak/calculations/decrypt.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.AshCloak.Calculations.Decrypt':calculate/3"}]}]}], "published": "2026-08-30T18:16:59.157", "references": [{"url": "https://cna.erlef.org/cves/CVE-2026-81319.html", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/ash-project/ash_cloak/commit/1690f0a436efe3e7c11d70d74ff5a8ac0fdf6608", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/ash-project/ash_cloak/security/advisories/GHSA-rc26-mrm2-6pf9", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-81319", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/ash-project/ash_cloak/security/advisories/GHSA-rc26-mrm2-6pf9", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption.\n\nAshCloak.Calculations.Decrypt decodes the decrypted binary with Ash.Helpers.non_executable_binary_to_term/1 without the :safe option, so atoms in the payload are interned during the decode and never garbage collected, and the term format's compressed form is inflated transparently. vault.decrypt!() is the only barrier and stops tampering only for an authenticated cipher. Cloak also ships the unauthenticated AES.CTR, whose ciphertext an attacker who knows their own plaintext can XOR into any same-length payload without the key, so an ordinary read of the forged column reaches the decoder. A few hundred kilobytes of distinct atoms exhausts the atom table, or a small compressed payload inflates to gigabytes.\n\nThis issue affects ash_cloak: from 0.1.0 before 0.4.0."}], "lastModified": "2026-09-01T21:15:00.147", "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}