The vulnerability arises because Ecto expands interpolated JSON path elements and splice lists directly into the query expression, causing each unique key or list length to generate a new cache entry. This leads to unbounded growth in an ETS table that stores prepared queries, consuming application memory and creating prepared statements on the database without eviction. An attacker can trigger rapid memory exhaustion by sending many requests with distinct keys or lengths, potentially causing denial of service at both the application and database server. This is a classic resource exhaustion flaw categorized as CWE‑770.

Affected products are the Elixir Ecto library, from version 3.4.0 up to, but not including, 3.14.3. The vulnerability exists in both the core ecto and ecto_sql components. Any application using Ecto with an unsupported version is susceptible.

The CVSS score of 8.9 indicates a high severity. EPSS data is currently not available, so the precise likelihood of exploitation is uncertain, but the lack of eviction and unlimited memory and ready‑to‑use in production environments suggest a plausible threat. The vulnerability is not listed in CISA KEV catalog. Attackers can exploit it remotely without authentication by issuing crafted queries over the network, making this a high‑risk scenario if the application is exposed.