CVE-2026-118391

Name of the Vulnerable Software and Affected Versions ecto versions 3.4.0 through 3.14.2

Description An unauthenticated remote attacker can cause memory exhaustion in both the application and the database server. This occurs when the application interpolates user-supplied data into json extract path/2, field[^key], or splice/1. Ecto caches prepared queries in an ETS table without size limits or eviction policies. Because interpolated JSON path elements and splice/1 expansions become part of the query expression rather than parameters, every unique key or list length creates a new cache entry. When using ecto sql, each entry also generates a new prepared statement on the database connection. This memory is not released until the processes restart.

Recommendations Upgrade ecto to version 3.14.3 or later. As a temporary workaround, pass the path as a query parameter to prevent it from becoming part of the cache key (e.g., using fragment("? #> ?", i.meta, type(^path, {:array, :string})) for PostgreSQL). As a temporary workaround, disable the cache for affected queries by setting query cache: false in the Repo.all() call. As a temporary workaround, restrict keys and list lengths to a predefined known set before constructing the query.