CVE-2026-82722— AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)
Quick assessment
Affected
ash-project ash_admin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ash-admin 中资源分配无限制或无节流漏洞，使得任何能够访问管理端 LiveView 的客户端都能耗尽 BEAM 原语表（atom table），从而导致整个节点崩溃。 两个 LiveView 事件处理程序从未经校验的客户端输入中创建原语（interned atoms）： 的 使用 根据资源/域负载构建模块； 的 使用 将每个提交表单的键转换为原语。 由于原语永远不会被垃圾回收，且原语表容量有限，因此通过向这两个事件发送随机名称，每次请求都会创建一个新的原语，直到虚拟机中止运行，进而导致该节点上的所有应用都停
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82722
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)
Source: CVE Program / CVE List V5
Vulnerability Description
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node.
Two LiveView event handlers interned atoms from unvalidated client input: AshAdmin.PageLive's set_actor built modules from the resource/domain payload with Module.concat/1, and AshAdmin.Components.Resource.Show's calculate converted every submitted form key with String.to_atom/1. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted resource/domain against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned.
This issue affects ash_admin: from 0.1.0 before 1.3.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ash-project | ash_admin | 0.1.0 ~ 1.3.1 |
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*
|
|
| ash-project | ash_admin | 98b03baa8422b94dd13e305bf08b8ee3f7232c7b ~ 731dffa09416d68f4ad3a0b6ee146b285ca0083b |
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-82722
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82722
请登录查看更多情报信息。
Other References for CVE-2026-82722 (4)
-
https://github.com/ash-project/ash_admin/security/advisories/GHSA-wcr6-9rrw-5jhv vendor-advisory related
Same Patch Batch · ash-project · 2026-08-31 · 13 CVEs total
| CVE-2026-77956 | 10.0 CRITICAL | EEx template evaluation of prompt content in AshAi enables remote code execution |
| CVE-2026-77850 | 8.4 HIGH | Stored XSS in AshAdmin relationship typeahead via unescaped label_field content |
| CVE-2026-82673 | 8.3 HIGH | Path traversal in AshAdmin file uploads via unsanitized client filename |
| CVE-2026-75757 | 8.3 HIGH | AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a |
| CVE-2026-81315 | 7.4 HIGH | MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header |
| CVE-2026-75760 | 7.1 HIGH | AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a us |
| CVE-2026-82564 | 7.1 HIGH | Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unident |
| CVE-2026-82579 | 6.0 MEDIUM | AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of |
| CVE-2026-82580 | 5.3 MEDIUM | AshAi echoes raw tool exception messages into the conversation, disclosing internal detail |
| CVE-2026-81853 | 2.3 LOW | AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attrib |
| CVE-2026-81852 | 2.1 LOW | AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass |
| CVE-2026-82681 | 2.0 LOW | Query-parameter injection in AshAdmin row-action links via unencoded string primary keys |
IV. Related Vulnerabilities
Same product: ash_admin
-
CVE-2026-82673
Path traversal in AshAdmin file uploads via unsanitized clie -
CVE-2026-81853
AshAdmin composite primary key decoding accepts arbitrary fi -
CVE-2026-81852
AshAdmin ships a hardcoded CSP nonce, allowing nonce-based C -
CVE-2026-82681
Query-parameter injection in AshAdmin row-action links via u -
CVE-2026-77850
Stored XSS in AshAdmin relationship typeahead via unescaped
Same vendor: ash-project
-
CVE-2026-82673
Path traversal in AshAdmin file uploads via unsanitized clie -
CVE-2026-81853
AshAdmin composite primary key decoding accepts arbitrary fi -
CVE-2026-81852
AshAdmin ships a hardcoded CSP nonce, allowing nonce-based C -
CVE-2026-82681
Query-parameter injection in AshAdmin row-action links via u -
CVE-2026-77850
Stored XSS in AshAdmin relationship typeahead via unescaped
Same weakness: CWE-770
-
CVE-2026-81636
Query-complexity limit bypass via first/last pagination argu -
CVE-2026-82562
qs.parse does not enforce arrayLimit on comma groups under b -
CVE-2026-3686
Vulnerabilities exists in IBM Cloud Pak for Data System -
CVE-2026-54788
dd-trace-rs: Unbounded W3C tracestate parsing may lead to Do -
CVE-2026-81285
WordPress Smush Image Compression and Optimization plugin <=
V. Comments for CVE-2026-82722
No comments yet