Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-74837— Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter

Quick assessment

Affected

ash-project ash_typescript

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Ash Framework AshTypescript是Ash Framework组织的一款面向开发者的类型安全辅助工具。 Ash Framework AshTypescript 0.1.0版本至0.18.0之前版本存在资源管理错误漏洞，该漏洞源于资源分配无限制或节流，具体为将客户端提供的RPC字段名转换为原子时未设置白名单、长度限制或速率限制，导致攻击者可通过大量不同字段名耗尽BEAM原子表，造成节点中止（拒绝服务）。

CVSS 8.7 · High EPSS 0.55% · P45 Updated Sep 01, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 2

Vendor	Product	Version Range	Status
ash-project	ash_typescript	`0.1.0< 0.18.0`	affected
		`1a3d4c343430c8e4784acfcd33122a807fafa086< df95df4b9afdca5e5bbce32dbd566ccc49a7f14b`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74837

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter

Source: CVE Program / CVE List V5

Vulnerability Description

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.convert_to_field_atom/2 in lib/ash_typescript/field_formatter.ex converts a client-supplied field name to an atom with String.to_atom/1 when no matching atom already exists. It delegates first to parse_input_field/2, which resolves the name with String.to_existing_atom/1 and falls back to returning the plain string; convert_to_field_atom/2 then mints an atom from that string rather than treating the name as unknown. RPC field selection reaches it for every requested field name through AshTypescript.Rpc.FieldProcessing.FieldSelector, which resolves each name before checking that the field exists, with no allowlist, length bound, or rate limit. Atoms are never garbage collected, so each distinct name mints a permanent one and the VM aborts once the atom table limit is reached. A field name over 255 characters additionally raises an uncaught SystemLimitError. This issue affects ash_typescript: from 0.1.0 before 0.18.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Vulnerability Title

Ash Framework AshTypescript 资源管理错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ash-project	ash_typescript	0.1.0 ~ 0.18.0	`cpe:2.3:a:ash-project:ash_typescript::::::::`
ash-project	ash_typescript	1a3d4c343430c8e4784acfcd33122a807fafa086 ~ df95df4b9afdca5e5bbce32dbd566ccc49a7f14b	`cpe:2.3:a:ash-project:ash_typescript::::::::`

II. Public POCs for CVE-2026-74837

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-74837

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74837 (1)

🔗 fix(rpc): prevent atom-table exhaustion from client-supplied field names · ash-project/ash_typescript@df95df4 · GitHub Read full article patch

Vendor Advisories for CVE-2026-74837 (3)

🔗 AshTypescript vulnerable to BEAM atom table exhaustion via client-supplied RPC field names · Advisory · ash-project/ash_typescript · GitHub Read full article related vendor-advisory
🔗 CVE-2026-74837 Read full article related
🔗 EEF-CVE-2026-74837 - OSV Read full article related

https://www.cve.org/CVERecord?id=CVE-2026-74837

Same Patch Batch · ash-project · 2026-09-01 · 23 CVEs total

CVE-2026-77856	8.2 HIGH	Unbounded atom creation from typed struct field names in AshTypescript field selector
CVE-2026-82730	8.2 HIGH	Authorization-redacted field values disclosed through AshTypescript result normalization
CVE-2026-77950	6.3 MEDIUM	RPC error handler fails open in AshTypescript, disclosing unredacted errors
CVE-2026-82733	6.3 MEDIUM	Route handler return value echoed into AshTypescript error response
CVE-2026-82732	6.3 MEDIUM	Declared argument constraints not enforced on AshTypescript typed controller routes
CVE-2026-82747	5.9 MEDIUM	Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
CVE-2026-82749	5.9 MEDIUM	Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is
CVE-2026-82746	5.9 MEDIUM	Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to for
CVE-2026-82745	5.9 MEDIUM	ETS and Mnesia data layers overwrite an existing record on create instead of enforcing pri
CVE-2026-82737	5.9 MEDIUM	Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting
CVE-2026-82735	5.9 MEDIUM	Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service
CVE-2026-82742	5.9 MEDIUM	Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships,
CVE-2026-82738	5.9 MEDIUM	Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of
CVE-2026-82731	2.3 LOW	Unescaped path parameters in AshTypescript generated TypeScript client allow request redir
CVE-2026-82736	2.1 LOW	Ash.Type.CiString validates length and match constraints before case folding, allowing con
CVE-2026-82741	2.1 LOW	Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion
CVE-2026-82740	2.1 LOW	Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs
CVE-2026-82734	2.1 LOW	Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal
CVE-2026-82743	2.1 LOW	Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads
CVE-2026-82744	2.1 LOW	Ash.Reactor change step fails open, skipping a change when its where guard raises

Showing top 20 of 23 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: ash_typescript

Same vendor: ash-project

Same weakness: CWE-770