{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-81319", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-08-30T05:45:01.821Z", "datePublished": "2026-08-30T18:05:13.889Z", "dateUpdated": "2026-08-30T18:05:13.889Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.AshCloak.Calculations.Decrypt'"], "packageName": "ash_cloak", "packageURL": "pkg:hex/ash_cloak", "product": "ash_cloak", "programFiles": ["lib/ash_cloak/calculations/decrypt.ex"], "programRoutines": [{"name": "'Elixir.AshCloak.Calculations.Decrypt':calculate/3"}], "repo": "https://github.com/ash-project/ash_cloak", "vendor": "ash-project", "versions": [{"lessThan": "0.4.0", "status": "affected", "version": "0.1.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.AshCloak.Calculations.Decrypt'"], "packageName": "ash-project/ash_cloak", "packageURL": "pkg:github/ash-project/ash_cloak", "product": "ash_cloak", "programFiles": ["lib/ash_cloak/calculations/decrypt.ex"], "programRoutines": [{"name": "'Elixir.AshCloak.Calculations.Decrypt':calculate/3"}], "repo": "https://github.com/ash-project/ash_cloak", "vendor": "ash-project", "versions": [{"lessThan": "1690f0a436efe3e7c11d70d74ff5a8ac0fdf6608", "status": "affected", "version": "f1595a77fdfa9bfc672f84c2f77feb9e7bf895fc", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An application must use ash_cloak with an unauthenticated vault cipher (for example the <code>AES.CTR</code> cipher shipped by Cloak), or run in a deployment where the stored ciphertext can be modified, and read a cloaked field so the decrypt calculation runs.</p>"}, {"base64": false, "type": "text/markdown", "value": "An application must use ash_cloak with an unauthenticated vault cipher (for example the `AES.CTR` cipher shipped by Cloak), or run in a deployment where the stored ciphertext can be modified, and read a cloaked field so the decrypt calculation runs."}], "value": "An application must use ash_cloak with an unauthenticated vault cipher (for example the AES.CTR cipher shipped by Cloak), or run in a deployment where the stored ciphertext can be modified, and read a cloaked field so the decrypt calculation runs."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.4.0", "versionStartIncluding": "0.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "reporter", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Zach Daniel / Ash Project"}, {"lang": "en", "type": "coordinator", "value": "Jonatan M\u00e4nnchen / EEF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption.</p>\n<p><code>AshCloak.Calculations.Decrypt</code> decodes the decrypted binary with <code>Ash.Helpers.non_executable_binary_to_term/1</code> without the <code>:safe</code> option, so atoms in the payload are interned during the decode and never garbage collected, and the term format's compressed form is inflated transparently. <code>vault.decrypt!()</code> is the only barrier and stops tampering only for an authenticated cipher. Cloak also ships the unauthenticated <code>AES.CTR</code>, whose ciphertext an attacker who knows their own plaintext can XOR into any same-length payload without the key, so an ordinary read of the forged column reaches the decoder. A few hundred kilobytes of distinct atoms exhausts the atom table, or a small compressed payload inflates to gigabytes.</p>\n<p>This issue affects ash_cloak: from 0.1.0 before 0.4.0.</p>"}, {"base64": false, "type": "text/markdown", "value": "Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption.\n\n`AshCloak.Calculations.Decrypt` decodes the decrypted binary with `Ash.Helpers.non_executable_binary_to_term/1` without the `:safe` option, so atoms in the payload are interned during the decode and never garbage collected, and the term format's compressed form is inflated transparently. `vault.decrypt!()` is the only barrier and stops tampering only for an authenticated cipher. Cloak also ships the unauthenticated `AES.CTR`, whose ciphertext an attacker who knows their own plaintext can XOR into any same-length payload without the key, so an ordinary read of the forged column reaches the decoder. A few hundred kilobytes of distinct atoms exhausts the atom table, or a small compressed payload inflates to gigabytes.\n\nThis issue affects ash_cloak: from 0.1.0 before 0.4.0."}], "value": "Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption.\n\nAshCloak.Calculations.Decrypt decodes the decrypted binary with Ash.Helpers.non_executable_binary_to_term/1 without the :safe option, so atoms in the payload are interned during the decode and never garbage collected, and the term format's compressed form is inflated transparently. vault.decrypt!() is the only barrier and stops tampering only for an authenticated cipher. Cloak also ships the unauthenticated AES.CTR, whose ciphertext an attacker who knows their own plaintext can XOR into any same-length payload without the key, so an ordinary read of the forged column reaches the decoder. A few hundred kilobytes of distinct atoms exhausts the atom table, or a small compressed payload inflates to gigabytes.\n\nThis issue affects ash_cloak: from 0.1.0 before 0.4.0."}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 5.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-08-30T18:05:13.889Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/ash-project/ash_cloak/security/advisories/GHSA-rc26-mrm2-6pf9"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-81319.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-81319"}, {"tags": ["patch"], "url": "https://github.com/ash-project/ash_cloak/commit/1690f0a436efe3e7c11d70d74ff5a8ac0fdf6608"}], "source": {"discovery": "EXTERNAL"}, "title": "Unsafe deserialization of decrypted terms enables node DoS in AshCloak"}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.AshCloak.Calculations.Decrypt'"], "packageName": "ash_cloak", "packageURL": "pkg:hex/ash_cloak", "product": "ash_cloak", "programFiles": ["lib/ash_cloak/calculations/decrypt.ex"], "programRoutines": [{"name": "'Elixir.AshCloak.Calculations.Decrypt':calculate/3"}], "repo": "https://github.com/ash-project/ash_cloak", "vendor": "ash-project", "versions": [{"lessThan": "0.4.0", "status": "affected", "version": "0.1.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.AshCloak.Calculations.Decrypt'"], "packageName": "ash-project/ash_cloak", "packageURL": "pkg:github/ash-project/ash_cloak", "product": "ash_cloak", "programFiles": ["lib/ash_cloak/calculations/decrypt.ex"], "programRoutines": [{"name": "'Elixir.AshCloak.Calculations.Decrypt':calculate/3"}], "repo": "https://github.com/ash-project/ash_cloak", "vendor": "ash-project", "versions": [{"lessThan": "1690f0a436efe3e7c11d70d74ff5a8ac0fdf6608", "status": "affected", "version": "f1595a77fdfa9bfc672f84c2f77feb9e7bf895fc", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption.\n\nAshCloak.Calculations.Decrypt decodes the decrypted binary with Ash.Helpers.non_executable_binary_to_term/1 without the :safe option, so atoms in the payload are interned during the decode and never garbage collected, and the term format's compressed form is inflated transparently. vault.decrypt!() is the only barrier and stops tampering only for an authenticated cipher. Cloak also ships the unauthenticated AES.CTR, whose ciphertext an attacker who knows their own plaintext can XOR into any same-length payload without the key, so an ordinary read of the forged column reaches the decoder. A few hundred kilobytes of distinct atoms exhausts the atom table, or a small compressed payload inflates to gigabytes.\n\nThis issue affects ash_cloak: from 0.1.0 before 0.4.0."}], "id": "CVE-2026-81319", "lastModified": "2026-08-30T18:16:59.157", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}, "published": "2026-08-30T18:16:59.157", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-81319.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/ash-project/ash_cloak/commit/1690f0a436efe3e7c11d70d74ff5a8ac0fdf6608"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/ash-project/ash_cloak/security/advisories/GHSA-rc26-mrm2-6pf9"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-81319"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{}