{"metadata": {"vulnerability": "CVE-2026-8469", "count": 15, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-05-13T11:44:43.316Z", "date_only": false, "value": "2026-05-13T11:44:43.316Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-8469", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-05-20T11:02:18Z", "date_only": false, "value": "2026-05-20T11:02:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q", "record": "CVE-2026-8469", "field": "creation_timestamp", "uuid": "e87e94eb-74a5-4341-a723-ca60facd5c08", "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-05-20T13:35:27.914Z", "date_only": false, "value": "2026-05-20T13:35:27.914Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-8469", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-20T14:17:04Z", "date_only": false, "value": "2026-05-20T14:17:04Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-833P-95JQ-929Q", "record": "GHSA-833P-95JQ-929Q", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-05-20T14:17:04.447Z", "date_only": false, "value": "2026-05-20T14:17:04.447", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-8469", "record": "FKIE_CVE-2026-8469", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-20T15:18:56.520Z", "date_only": false, "value": "2026-05-20T15:18:56.520995Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmc7caqjxm2i", "record": "CVE-2026-8469", "field": "creation_timestamp", "uuid": "efda3387-71ef-47fb-b4ac-6620c8365d99", "content": "CVE-2026-8469 - Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook\nCVE ID : CVE-2026-8469\n \n Published : May 20, 2026, 1:35 p.m. | 39\u00a0minutes ago\n \n Description : Allocation of Resources Without Limits or Throttling vulnerability in phenixdig...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmc7caqjxm2i"}, {"timestamp": "2026-05-21T13:55:42.783Z", "date_only": false, "value": "2026-05-21T13:55:42.783019Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-8469", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-05-21T13:55:42.783Z", "date_only": false, "value": "2026-05-21T13:55:42.783019Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-8469", "record": "FKIE_CVE-2026-8469", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-05-21T13:56:33.631Z", "date_only": false, "value": "2026-05-21T13:56:33.631Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-8469", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-27T15:40:55.927Z", "date_only": false, "value": "2026-05-27T15:40:55.927Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-8469", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-05-27T15:40:55.927Z", "date_only": false, "value": "2026-05-27T15:40:55.927Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / EEF", "record": "CVE-2026-8469", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-09T21:59:07Z", "date_only": false, "value": "2026-06-09T21:59:07Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-833P-95JQ-929Q", "record": "GHSA-833P-95JQ-929Q", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-06-09T21:59:07Z", "date_only": false, "value": "2026-06-09T21:59:07Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-833P-95JQ-929Q", "record": "GHSA-833P-95JQ-929Q", "field": "modified"}, {"timestamp": "2026-06-09T23:11:25Z", "date_only": false, "value": "2026-06-09T23:11:25.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/c5822daca832e3ff7c46650aefcc77c9", "record": "CVE-2026-8469", "field": "creation_timestamp", "uuid": "3e960b0d-998a-4dd4-a35f-a2d8b6b4556f", "content": "# CVE-2026-8469: CVE-2026-8469: Denial of Service via BEAM Atom Table Exhaustion in phoenix_storybook\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-06-09\n> **Full Report:** https://cvereports.com/reports/CVE-2026-8469\n\n## Summary\nAn unauthenticated Denial-of-Service (DoS) vulnerability exists in phoenix_storybook versions 0.2.0 through 1.0.11 due to allocation of resources without limits (CWE-770). The application dynamically converts user-supplied parameter keys to atoms, leading to BEAM Atom Table exhaustion and immediate virtual machine crash.\n\n## TL;DR\nUnauthenticated remote attackers can crash the entire Elixir application by exhausting the Erlang VM atom table via crafted websocket payloads targeting the storybook playground.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.2 (High)\n- **Exploit Status**: Proof-of-Concept\n- **Affected Versions**: >= 0.2.0, < 1.1.0\n- **Remediation**: Upgrade to version 1.1.0 or higher\n\n## Affected Systems\n\n- phoenix_storybook (Elixir Hex Package)\n- **phoenix_storybook**: >= 0.2.0, < 1.1.0 (Fixed in: `1.1.0`)\n\n## Mitigation\n\n- Upgrade phoenix_storybook to version 1.1.0 or higher\n- Implement strict authentication and authorization plugs on storybook routes\n- Configure the Erlang VM with larger atom table limits (+t) as a temporary measure\n\n**Remediation Steps:**\n1. Open the mix.exs file in the project root\n2. Update the phoenix_storybook entry to depend on '~> 1.1.0'\n3. Run 'mix deps.get' to fetch and resolve dependencies\n4. Recompile the application and execute automated tests to verify stability\n5. Deploy the updated build to production environments\n\n## References\n\n- [GitHub Security Advisory GHSA-833p-95jq-929q](https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q)\n- [Fix commit 96d524690af0fe197a49f60d18e564a620b9ef81](https://github.com/phenixdigital/phoenix_storybook/commit/96d524690af0fe197a49f60d18e564a620b9ef81)\n- [Erlang Ecosystem Foundation CVE CVE-2026-8469](https://cna.erlef.org/cves/CVE-2026-8469.html)\n- [OSV Vulnerability Entry EEF-CVE-2026-8469](https://osv.dev/vulnerability/EEF-CVE-2026-8469)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-8469) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/c5822daca832e3ff7c46650aefcc77c9"}, {"timestamp": "2026-07-23T12:10:00.110Z", "date_only": false, "value": "2026-07-23T12:10:00.110", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-8469", "record": "FKIE_CVE-2026-8469", "field": "lastModified"}], "metrics": {"as_of": "2026-10-28T15:34:36.062Z", "anchors": {"origin": {"timestamp": "2026-05-20T13:35:27.914Z", "date_only": false, "value": "2026-05-20T13:35:27.914Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-8469", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-05-20T13:35:27.914Z", "date_only": false, "value": "2026-05-20T13:35:27.914Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-8469", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-05-20T11:02:18Z", "date_only": false, "value": "2026-05-20T11:02:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q", "record": "CVE-2026-8469", "field": "creation_timestamp", "uuid": "e87e94eb-74a5-4341-a723-ca60facd5c08", "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -9189.914, "hours": -2.552753888888889, "days": -0.10636474537037038, "min_seconds": -9189.914, "max_seconds": -9189.914, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-05-20T13:35:27.914Z", "date_only": false, "value": "2026-05-20T13:35:27.914Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-8469", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-05-20T11:02:18Z", "date_only": false, "value": "2026-05-20T11:02:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q", "record": "CVE-2026-8469", "field": "creation_timestamp", "uuid": "e87e94eb-74a5-4341-a723-ca60facd5c08", "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 13917548.148116, "hours": 3865.985596698889, "days": 161.08273319578703, "min_seconds": 13917548.148116, "max_seconds": 13917548.148116, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-05-20T13:35:27.914Z", "date_only": false, "value": "2026-05-20T13:35:27.914Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-8469", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-28T15:34:36.062Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 13926738.062116, "hours": 3868.538350587778, "days": 161.18909794115743, "min_seconds": 13926738.062116, "max_seconds": 13926738.062116, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-05-20T11:02:18Z", "date_only": false, "value": "2026-05-20T11:02:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q", "record": "CVE-2026-8469", "field": "creation_timestamp", "uuid": "e87e94eb-74a5-4341-a723-ca60facd5c08", "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-28T15:34:36.062Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}