The vulnerability is an unsafe deserialization of untrusted data that occurs when Ash Cloak decrypts binary payloads. Because the binary is decoded with non_executable_binary_to_term/1 without the :safe option, atoms created from the payload are interned and never garbage collected. An attacker can craft a payload that creates a large number of unique atoms or a small compressed term that expands to gigabytes when inflated. This causes the BEAM node to run out of memory or atom table entries, leading to a crash. The flaw is a classic case of insecure deserialization described by CWE‑502 and results in a denial‑of‑service condition on the affected node.

The flaw affects the Ash Project’s Ash Cloak library. Versions 0.1.0 through just before 0.4.0 are vulnerable. The product is distributed under the Ash Cloak name and can be identified by its vendor and product names, ash-project and ash_cloak.

The CVSS score of 5.9 indicates a medium risk when combined with the lack of publicly available EPSS data, making the actual exploitation probability uncertain. An attacker must be able to influence the bytes of an encrypted column; this can be achieved by XORing their own plaintext into an unauthenticated AES.CTR ciphertext since the library accepts such input during decryption. If the attacker gains this capability, they can trigger atom flooding or a decompression bomb. The vulnerability is not listed in CISA’s KEV catalog, so there are no known widespread exploit campaigns at this time, but the potential for a crash makes the threat moderate.