The vulnerability arises when the AshTypescript field selector resolves typed struct field names for incoming RPC messages. If a client supplies a field name that does not exist in the struct's reverse map, the resolver falls back to the BEAM function String.to_atom/1. Because atoms are immutable and never garbage collected, each request that contains an unknown field name results in a new atom being permanently added. Repeated use of distinct unknown field names can exhaust the BEAM atom table, causing the Erlang virtual machine to terminate and abort the node. The flaw allows an unauthenticated attacker to trigger large numbers of unique atoms through crafted requests, leading to denial of service.

The affected product is AshProject’s AshTypescript, a library used for typed struct field selection in Erlang/Elixir applications. Vulnerable releases are those that include the unbounded atom creation logic, specifically versions from 0.11.0 up to but not including 0.18.0. Any application that depends on these versions of AshTypescript and exposes an RPC endpoint that passes user-controlled field names is at risk.

The CVSS score of 8.2 indicates high severity. The EPSS score is not available, but the lack of an official KEV listing does not diminish the impact for systems that expose the vulnerable interface. The attack can be carried out remotely via the RPC interface without authentication. An attacker can overwhelm the atom table by sending a large volume of distinct field names, ultimately causing the node to crash and lead to service interruption. The exploit requires only network access to the exposed endpoint and no privileged credentials, making it a high risk for publicly accessible nodes.