The flaw occurs because Ash stores attributes of type :atom as strings but compares them as strings. When a filter is applied to a public :atom attribute that is marked unsafe_to_atom?: true, the incoming filter value is coerced through Ash.Type.Atom using the default cast_input/2 implementation. That implementation converts the string to an Erlang atom via String.to_atom/1. Since atoms are never garbage collected, each distinct value to which a user can apply a filter generates a new permanent atom. Over time, an attacker can exhaust the BEAM atom table, causing the Erlang Virtual Machine to crash and result in a denial‑of‑service attack. The flaw affects not only Ash itself but also projects that expose such attributes, notably AshPaperTrail’s version_action_name field.

All installed versions of Ash from 3.5.1 up to and including 3.34.2 are vulnerable. The issue was resolved in Ash 3.34.3 by adding a coerce/2 implementation that leaves the comparison value as a string, preventing unsafe atom internment. Users should verify the exact version they run and plan an upgrade if it lies in the affected range.

The CVSS score of 8.2 indicates high severity. EPSS data is currently not available, which means the likelihood of exploitation cannot be quantified but the lack of mitigation in earlier releases leaves systems susceptible. The attack vector is inferred to be network‑based, as an attacker can supply filter values through any public endpoint that accepts the :atom attribute, such as AshPaperTrail’s version resources. Once the atom table is saturated, the entire node process will terminate, causing a denial‑of‑service.