CVE-2026-81319

Name of the Vulnerable Software and Affected Versions ash cloak versions 0.1.0 through 0.3.x

Description An issue exists where the deserialization of untrusted data allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node. This is achieved by triggering unbounded atom creation or a decompression bomb during decryption. The AshCloak.Calculations.Decrypt function decodes the decrypted binary using Ash.Helpers.non executable binary to term/1 without the :safe option, causing atoms in the payload to be interned and never garbage collected, while compressed forms are inflated transparently. This is particularly critical when using unauthenticated ciphers like AES.CTR, as an attacker knowing their own plaintext can XOR the ciphertext into a forged payload. A small compressed payload can inflate to gigabytes, or a few hundred kilobytes of distinct atoms can exhaust the atom table.

Recommendations Update ash cloak to version 0.4.0 or later. Avoid using unauthenticated vault ciphers, such as AES.CTR, to prevent unauthorized modification of ciphertext.