CVE-2026-81319 ash-project CVE debrief

Who should care

Users of ash-project ash_cloak versions between 0.1.0 and 0.4.0 should apply patches or mitigations to prevent potential denial of service attacks. This includes operators, security teams, and vulnerability management teams responsible for maintaining affected systems.

Technical summary

The vulnerability exists in the AshCloak.Calculations.Decrypt function, which decodes decrypted binary data without using the :safe option. This allows an attacker to create unbounded atoms or trigger a decompression bomb, potentially crashing the BEAM node. The issue affects ash_cloak versions from 0.1.0 before 0.4.0. To mitigate, users should apply patches or implement compensating controls. The vulnerability can be exploited by influencing the bytes of an encrypted column, which can lead to a denial of service attack. The AshCloak.Calculations.Decrypt function decodes the decrypted binary with Ash.Helpers.non_executable_binary_to_term/1 without the :safe option, so atoms in the payload are interned during the decode and never garbage collected.

Defensive priority

Medium priority due to potential for denial of service

Recommended defensive actions

• Review and apply vendor patches for ash_cloak versions between 0.1.0 and 0.4.0
• Implement compensating controls to detect and prevent potential exploitation attempts
• Monitor system logs for unusual activity related to BEAM node crashes
• Review system configurations for exposed ash_cloak deployments
• Assess the security posture of affected systems
• Track exceptions and retest remediated assets

Evidence notes

Evidence from official sources indicates a Deserialization of Untrusted Data vulnerability in ash_cloak, allowing an attacker to crash the BEAM node by triggering unbounded atom creation or a decompression bomb during decryption. Limited details are available on affected systems and exploitation attempts. To verify, defenders should review official advisories, assess their exposure, and monitor for unusual BEAM node activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.