This vulnerability allows any client that can reach the AshAdmin admin LiveView to send specially crafted events that intern atoms from unvalidated user input. By creating a new atom for each request, the attacker exhausts the BEAM atom table. Because atoms are never garbage collected and the table is capped, the node will eventually abort, causing a crash and a loss of availability for all applications running on that node. The weakness is a classic example of resource exhaustion, classified as CWE-770.

The affected product is AshAdmin from the ash-project. Versions from 0.1.0 through 1.3.0 inclusive are vulnerable, as the issue exists up to and including version 1.3.0. All earlier releases before 0.1.0 are not affected.

The CVSS score of 8.3 reflects a high severity risk. Because the exploit can be performed remotely by any user capable of contacting the admin LiveView, the likelihood of exploitation is significant. The EPSS score is not available, but the absence of a KEV listing does not reduce the need for mitigation. An attacker could successfully trigger a denial-of-service by flooding the vulnerable LiveView events with random payloads to exhaust the atom table.