The vulnerability arises from unchecked conversion of user‑provided strings to BEAM atoms in several LiveView event handlers. BEAM atoms are permanent and not garbage‑collected. An attacker can send a large number of unique strings, quickly exhausting the atom table, which has a fixed ceiling of around one million entries. When the table overflows, the BEAM node aborts, immediately terminating all applications running on it. This results in an immediate denial of service to any process relying on the affected node.

The flaw affects versions of the PhoenixStorybook application from 0.2.0 up to, but not including, 1.1.0. All deployments running these versions, regardless of other software installed on the same BEAM node, are at risk because the atom table is shared across the entire virtual machine.

With a CVSS score of 8.2, this issue presents a high severity risk. No EPSS score is publicly available, so the exact current exploitation probability cannot be quantified, but the vulnerability permits unauthenticated exploitation over any interface that delivers LiveView event payloads, such as web pages. Once triggered, the atom table exhaustion takes down the entire BEAM node, and there is no built‑in mitigation; the affected application must be updated or configured to restrict atom creation. The vulnerability is not listed in CISA KEV, yet the lack of throttling and permanent atom allocation make exploitation straightforward for a motivated attacker.