Ash Framework, a declarative framework for Elixir applications, had a flaw in the function Ash.Type.Module.cast_input/2 that allowed an attacker to create new Erlang atoms from any user‑supplied binary starting with "Elixir." without verifying module existence. Because atoms are never garbage‑collected and the BEAM atom table has a fixed limit of about 1,048,576 entries, repeated use of this function can exhaust the table and crash the BEAM virtual machine, causing a denial of service for the entire application. The weakness is classified as CWE‑400, uncontrolled resource consumption.

The affected product is the Ash Framework (ash-project:ash). All versions prior to 3.22.0 are vulnerable; the issue was addressed in the 3.22.0 release.

The CVSS base score is 8.2, indicating high severity. No EPSS score is available and the vulnerability is not listed in KEV. The likely attack vector is through any input that is passed to a :module typed attribute or function argument; if an attacker can submit such data remotely—as through an API or web form—they can induce atom exhaustion. Successful exploitation would cause a BEAM VM crash and result in service downtime. No public exploit is known, but the easy trigger makes this a high‑risk vulnerability for exposed services.