CVE-2026-82722

Name of the Vulnerable Software and Affected Versions ash admin versions 0.1.0 through 1.3.0

Description An allocation of resources without limits or throttling allows clients with access to the admin LiveView to exhaust the BEAM atom table, causing the entire node to crash. This occurs because two LiveView event handlers intern atoms from unvalidated client input. Specifically, the set actor handler in AshAdmin.PageLive uses Module.concat/1 to build modules from the resource/domain payload, and the calculate handler in AshAdmin.Components.Resource.Show uses String.to atom/1 to convert submitted form keys. Since atoms are not garbage collected and the table has a fixed capacity, sending requests with random names continuously creates new atoms until the virtual machine aborts, affecting all applications on the node.

Recommendations Update ash admin to version 1.3.1 or later.