AshAdmin 1.3.1 fixes CVE-2026-8272: Unauthenticated LiveView event triggers atom table exhaustion DoS

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Name: Atom table exhaustion DoS in Vulnerability Type: A denial-of-service (DoS) attack caused by exhausting the BEAM atom table, triggered by sending a event to containing a large number of unique keys Trigger Method: An attacker repeatedly submits events carrying arbitrary keys, causing the atom table to reach its limit and crash the entire Erlang VM (crashing the LiveView process) Severity: High (CVSS 8.3/10) CVE Number: CVE-2026-8272 Affected Versions: Fixed Version: Attack Vector: Network Attack Complexity: Low Impact: Unauthenticated LiveView events can exhaust the atom table, causing the LiveView process to crash, impacting all applications exposing the AshAdmin service Scope of Impact Any application running AshAdmin Can be triggered by unauthenticated LiveView events Causes the entire Erlang VM to crash, impacting all applications exposing the AshAdmin service Remediation Upgrade to version 1.3.1 Fix Method: Add validation/restrictions on keys in to prevent unauthenticated requests from exhausting the atom table POC Code ```elixir POC: ash_admin 1.3.0 - unbounded atom creation from client-controlled form keys in the calculate LiveView component (lib/ash_admin/components/resource/show.ex:750-762). A threat model: an unauthenticated attacker who can reach the AshAdmin LiveView socket. This script stands up a real Phoenix application (Ranch) mounting AshAdmin's router, loads a record's show page over HTTP like a browser. Then opens a raw WebSocket to /live, joins the showview channel, and pushes a hand-crafted calculate event for string keys at the Show View's calculate. The event's name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), s

Goal Reached Thanks to every supporter — we hit 100%!

AshAdmin 1.3.1 fixes CVE-2026-8272: Unauthenticated LiveView event triggers atom table exhaustion DoS

More from this source