CVE-2026-118391— Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto

Quick assessment

Affected

elixir-ecto ecto

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Elixir 的 Ecto 框架存在“无限制或无节流机制的资源分配”漏洞。未认证的远程攻击者可以通过发送包含不同 JSON 键名或不同列表长度的请求，耗尽应用程序及数据库服务器的内存。该漏洞的成因在于：当应用程序将此类动态内容插值到、或等函数中时，Ecto 会在无大小限制且无淘汰机制的 ETS 表中，按仓库缓存预编译查询。由于插值的 JSON 路径元素会直接成为查询表达式的一部分（而非参数），而会为每个元素展开一个占位符，因此每一个不同的键名或列表长度都会生成一个新的缓存条目。在使用时，每个条目还会在对应

CVSS 8.9 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1499 · Endpoint Denial of Service

Affected Version Matrix 2

Vendor	Product	Version Range	Status
elixir-ecto	ecto	`3.4.0< 3.14.3`	affected
		`cb2f03964dac324a9771f84f5088e395326e6de8< eef014ad090d27d1a5b69c0e32a50eabd44ab3bb`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto

Source: CVE Program / CVE List V5

Vulnerability Description

Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where the application interpolates them into json_extract_path/2, field[^key] or splice/1. Ecto caches prepared queries per repository in an ETS table with no size limit and no eviction. Interpolated JSON path elements become part of the query expression instead of its parameters, and splice/1 expands into one placeholder per element, so every distinct key or list length creates a new cache entry. With ecto_sql each entry is also a new prepared statement on the database connection that runs it. None of this memory is released until the processes restart. This issue affects ecto: from 3.4.0 before 3.14.3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
elixir-ecto	ecto	3.4.0 ~ 3.14.3	`cpe:2.3:a:elixir-ecto:ecto::::::::`
elixir-ecto	ecto	cb2f03964dac324a9771f84f5088e395326e6de8 ~ eef014ad090d27d1a5b69c0e32a50eabd44ab3bb	`cpe:2.3:a:elixir-ecto:ecto::::::::`

II. Public POCs for CVE-2026-118391

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118391

请登录查看更多情报信息。

Other References for CVE-2026-118391 (11)

https://github.com/elixir-ecto/ecto/security/advisories/GHSA-cxjx-vmm2-qr8r vendor-advisory
https://ecto.hexdocs.pm/Ecto.Query.API.html#splice/1 technical-description
https://osv.dev/vulnerability/EEF-CVE-2026-118391 related
https://ecto.hexdocs.pm/Ecto.Query.API.html#json_extract_path/2 technical-description
https://cna.erlef.org/cves/CVE-2026-118391.html related
https://github.com/elixir-ecto/ecto/commit/eef014ad090d27d1a5b69c0e32a50eabd44ab3bb patch
https://github.com/elixir-ecto/ecto/commit/eb03f45b999e2bf67ffae92811233eb6e56dba55 related
https://github.com/elixir-ecto/ecto/commit/cb2f03964dac324a9771f84f5088e395326e6de8 related
https://github.com/elixir-ecto/ecto/issues/1031 related
https://github.com/elixir-ecto/ecto/issues/4470 related
https://github.com/elixir-ecto/ecto/commit/d0e97d8a6e274c81c25fbf08087da8d8b9bae0ea patch

https://www.cve.org/CVERecord?id=CVE-2026-118391

IV. Related Vulnerabilities

Same vendor: elixir-ecto

Same weakness: CWE-770