GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-77856 (GCVE-0-2026-77856)

Vulnerability from cvelistv5 – Published: 2026-09-01 02:08 – Updated: 2026-09-01 14:49
VLAI
Title
Unbounded atom creation from typed struct field names in AshTypescript field selector
Summary
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolve_typed_struct_field/2 in lib/ash_typescript/rpc/field_processing/field_selector.ex looks a client-supplied field name up in the typed struct's reverse map and, when it finds no match, falls back to String.to_atom/1. Because this runs before any field-existence check, an unresolvable name mints a permanent atom rather than being rejected as unknown. Atoms are never garbage collected, so a request carrying many distinct names on a typed struct field grows the atom table until the VM aborts at its limit. This issue affects ash_typescript: from 0.11.0 before 0.18.0.
Severity
8.2 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 14:49 UTC
CWE
  • CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
Vendor Product Version CPE status
ash-project ash_typescript Affected: 0.11.0 , < 0.18.0 (semver)
    cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*
Create a notification for this product.
ash-project ash_typescript Affected: 7c3d30896f2f9a54edea17e3787549776b1b288d , < 0ab5c83a7df28d51a6de1fb9b859a142b2b12919 (git)
    cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Peter Ullrich Peter Ullrich Torkild Gundersen Kjevik / Ash Project Jonatan Männchen / EEF
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77856",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T14:49:00.470737Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T14:49:22.592Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-rj47-h936-4cxw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027",
            "\u0027Elixir.AshTypescript.Rpc\u0027"
          ],
          "packageName": "ash_typescript",
          "packageURL": "pkg:hex/ash_typescript",
          "product": "ash_typescript",
          "programFiles": [
            "lib/ash_typescript/rpc/field_processing/field_selector.ex",
            "lib/ash_typescript/rpc.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027:resolve_typed_struct_field/2"
            },
            {
              "name": "\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3"
            }
          ],
          "repo": "https://github.com/ash-project/ash_typescript",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "0.18.0",
              "status": "affected",
              "version": "0.11.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027",
            "\u0027Elixir.AshTypescript.Rpc\u0027"
          ],
          "packageName": "ash-project/ash_typescript",
          "packageURL": "pkg:github/ash-project/ash_typescript",
          "product": "ash_typescript",
          "programFiles": [
            "lib/ash_typescript/rpc/field_processing/field_selector.ex",
            "lib/ash_typescript/rpc.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027:resolve_typed_struct_field/2"
            },
            {
              "name": "\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3"
            }
          ],
          "repo": "https://github.com/ash-project/ash_typescript",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "0ab5c83a7df28d51a6de1fb9b859a142b2b12919",
              "status": "affected",
              "version": "7c3d30896f2f9a54edea17e3787549776b1b288d",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe application exposes an AshTypescript RPC endpoint over HTTP and has at least one resource field backed by an \u003ccode\u003eAsh.TypedStruct\u003c/code\u003e, so that client-supplied names reach \u003ccode\u003eresolve_typed_struct_field/2\u003c/code\u003e.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The application exposes an AshTypescript RPC endpoint over HTTP and has at least one resource field backed by an `Ash.TypedStruct`, so that client-supplied names reach `resolve_typed_struct_field/2`."
            }
          ],
          "value": "The application exposes an AshTypescript RPC endpoint over HTTP and has at least one resource field backed by an Ash.TypedStruct, so that client-supplied names reach resolve_typed_struct_field/2."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.18.0",
                  "versionStartIncluding": "0.11.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Torkild Gundersen Kjevik / Ash Project"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eresolve_typed_struct_field/2\u003c/code\u003e in \u003ccode\u003elib/ash_typescript/rpc/field_processing/field_selector.ex\u003c/code\u003e looks a client-supplied field name up in the typed struct\u0027s reverse map and, when it finds no match, falls back to \u003ccode\u003eString.to_atom/1\u003c/code\u003e. Because this runs before any field-existence check, an unresolvable name mints a permanent atom rather than being rejected as unknown. Atoms are never garbage collected, so a request carrying many distinct names on a typed struct field grows the atom table until the VM aborts at its limit.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_typescript: from 0.11.0 before 0.18.0.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names.\n\n`resolve_typed_struct_field/2` in `lib/ash_typescript/rpc/field_processing/field_selector.ex` looks a client-supplied field name up in the typed struct\u0027s reverse map and, when it finds no match, falls back to `String.to_atom/1`. Because this runs before any field-existence check, an unresolvable name mints a permanent atom rather than being rejected as unknown. Atoms are never garbage collected, so a request carrying many distinct names on a typed struct field grows the atom table until the VM aborts at its limit.\n\nThis issue affects ash_typescript: from 0.11.0 before 0.18.0."
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names.\n\nresolve_typed_struct_field/2 in lib/ash_typescript/rpc/field_processing/field_selector.ex looks a client-supplied field name up in the typed struct\u0027s reverse map and, when it finds no match, falls back to String.to_atom/1. Because this runs before any field-existence check, an unresolvable name mints a permanent atom rather than being rejected as unknown. Atoms are never garbage collected, so a request carrying many distinct names on a typed struct field grows the atom table until the VM aborts at its limit.\n\nThis issue affects ash_typescript: from 0.11.0 before 0.18.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T02:08:46.189Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "related",
            "vendor-advisory"
          ],
          "url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-rj47-h936-4cxw"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-77856.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-77856"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ash-project/ash_typescript/commit/0ab5c83a7df28d51a6de1fb9b859a142b2b12919"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unbounded atom creation from typed struct field names in AshTypescript field selector"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-77856",
    "datePublished": "2026-09-01T02:08:46.189Z",
    "dateReserved": "2026-08-30T17:30:01.406Z",
    "dateUpdated": "2026-09-01T14:49:22.592Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-77856",
      "date": "2026-09-16",
      "epss": "0.00315",
      "percentile": "0.24388"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-77856\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-09-01T03:16:51.500\",\"lastModified\":\"2026-09-01T21:15:00.147\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names.\\n\\nresolve_typed_struct_field/2 in lib/ash_typescript/rpc/field_processing/field_selector.ex looks a client-supplied field name up in the typed struct\u0027s reverse map and, when it finds no match, falls back to String.to_atom/1. Because this runs before any field-existence check, an unresolvable name mints a permanent atom rather than being rejected as unknown. Atoms are never garbage collected, so a request carrying many distinct names on a typed struct field grows the atom table until the VM aborts at its limit.\\n\\nThis issue affects ash_typescript: from 0.11.0 before 0.18.0.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"ash-project\",\"product\":\"ash_typescript\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"ash_typescript\",\"cpes\":[\"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027\",\"\u0027Elixir.AshTypescript.Rpc\u0027\"],\"programFiles\":[\"lib/ash_typescript/rpc/field_processing/field_selector.ex\",\"lib/ash_typescript/rpc.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027:resolve_typed_struct_field/2\"},{\"name\":\"\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3\"}],\"repo\":\"https://github.com/ash-project/ash_typescript\",\"packageURL\":\"pkg:hex/ash_typescript\",\"versions\":[{\"version\":\"0.11.0\",\"lessThan\":\"0.18.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"ash-project\",\"product\":\"ash_typescript\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"ash-project/ash_typescript\",\"cpes\":[\"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027\",\"\u0027Elixir.AshTypescript.Rpc\u0027\"],\"programFiles\":[\"lib/ash_typescript/rpc/field_processing/field_selector.ex\",\"lib/ash_typescript/rpc.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027:resolve_typed_struct_field/2\"},{\"name\":\"\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3\"}],\"repo\":\"https://github.com/ash-project/ash_typescript\",\"packageURL\":\"pkg:github/ash-project/ash_typescript\",\"versions\":[{\"version\":\"7c3d30896f2f9a54edea17e3787549776b1b288d\",\"lessThan\":\"0ab5c83a7df28d51a6de1fb9b859a142b2b12919\",\"versionType\":\"git\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-01T14:49:00.470737Z\",\"id\":\"CVE-2026-77856\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-77856.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash_typescript/commit/0ab5c83a7df28d51a6de1fb9b859a142b2b12919\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash_typescript/security/advisories/GHSA-rj47-h936-4cxw\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-77856\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash_typescript/security/advisories/GHSA-rj47-h936-4cxw\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-77856\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-01T14:49:00.470737Z\"}}}], \"references\": [{\"url\": \"https://github.com/ash-project/ash_typescript/security/advisories/GHSA-rj47-h936-4cxw\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-01T14:49:17.165Z\"}}], \"cna\": {\"title\": \"Unbounded atom creation from typed struct field names in AshTypescript field selector\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Torkild Gundersen Kjevik / Ash Project\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-130\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-130 Excessive Allocation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.2, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ash-project/ash_typescript\", \"vendor\": \"ash-project\", \"modules\": [\"\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027\", \"\u0027Elixir.AshTypescript.Rpc\u0027\"], \"product\": \"ash_typescript\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.11.0\", \"lessThan\": \"0.18.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/ash_typescript\", \"packageName\": \"ash_typescript\", \"programFiles\": [\"lib/ash_typescript/rpc/field_processing/field_selector.ex\", \"lib/ash_typescript/rpc.ex\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027:resolve_typed_struct_field/2\"}, {\"name\": \"\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3\"}]}, {\"cpes\": [\"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ash-project/ash_typescript\", \"vendor\": \"ash-project\", \"modules\": [\"\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027\", \"\u0027Elixir.AshTypescript.Rpc\u0027\"], \"product\": \"ash_typescript\", \"versions\": [{\"status\": \"affected\", \"version\": \"7c3d30896f2f9a54edea17e3787549776b1b288d\", \"lessThan\": \"0ab5c83a7df28d51a6de1fb9b859a142b2b12919\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/ash-project/ash_typescript\", \"packageName\": \"ash-project/ash_typescript\", \"programFiles\": [\"lib/ash_typescript/rpc/field_processing/field_selector.ex\", \"lib/ash_typescript/rpc.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.AshTypescript.Rpc.FieldProcessing.FieldSelector\u0027:resolve_typed_struct_field/2\"}, {\"name\": \"\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3\"}]}], \"references\": [{\"url\": \"https://github.com/ash-project/ash_typescript/security/advisories/GHSA-rj47-h936-4cxw\", \"tags\": [\"related\", \"vendor-advisory\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-77856.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-77856\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/ash-project/ash_typescript/commit/0ab5c83a7df28d51a6de1fb9b859a142b2b12919\", \"tags\": [\"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names.\\n\\nresolve_typed_struct_field/2 in lib/ash_typescript/rpc/field_processing/field_selector.ex looks a client-supplied field name up in the typed struct\u0027s reverse map and, when it finds no match, falls back to String.to_atom/1. Because this runs before any field-existence check, an unresolvable name mints a permanent atom rather than being rejected as unknown. Atoms are never garbage collected, so a request carrying many distinct names on a typed struct field grows the atom table until the VM aborts at its limit.\\n\\nThis issue affects ash_typescript: from 0.11.0 before 0.18.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names.\u003c/p\u003e\\n\u003cp\u003e\u003ccode\u003eresolve_typed_struct_field/2\u003c/code\u003e in \u003ccode\u003elib/ash_typescript/rpc/field_processing/field_selector.ex\u003c/code\u003e looks a client-supplied field name up in the typed struct\u0027s reverse map and, when it finds no match, falls back to \u003ccode\u003eString.to_atom/1\u003c/code\u003e. Because this runs before any field-existence check, an unresolvable name mints a permanent atom rather than being rejected as unknown. Atoms are never garbage collected, so a request carrying many distinct names on a typed struct field grows the atom table until the VM aborts at its limit.\u003c/p\u003e\\n\u003cp\u003eThis issue affects ash_typescript: from 0.11.0 before 0.18.0.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names.\\n\\n`resolve_typed_struct_field/2` in `lib/ash_typescript/rpc/field_processing/field_selector.ex` looks a client-supplied field name up in the typed struct\u0027s reverse map and, when it finds no match, falls back to `String.to_atom/1`. Because this runs before any field-existence check, an unresolvable name mints a permanent atom rather than being rejected as unknown. Atoms are never garbage collected, so a request carrying many distinct names on a typed struct field grows the atom table until the VM aborts at its limit.\\n\\nThis issue affects ash_typescript: from 0.11.0 before 0.18.0.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of Resources Without Limits or Throttling\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"The application exposes an AshTypescript RPC endpoint over HTTP and has at least one resource field backed by an Ash.TypedStruct, so that client-supplied names reach resolve_typed_struct_field/2.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe application exposes an AshTypescript RPC endpoint over HTTP and has at least one resource field backed by an \u003ccode\u003eAsh.TypedStruct\u003c/code\u003e, so that client-supplied names reach \u003ccode\u003eresolve_typed_struct_field/2\u003c/code\u003e.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"The application exposes an AshTypescript RPC endpoint over HTTP and has at least one resource field backed by an `Ash.TypedStruct`, so that client-supplied names reach `resolve_typed_struct_field/2`.\", \"base64\": false}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"0.18.0\", \"versionStartIncluding\": \"0.11.0\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-09-01T02:08:46.189Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-77856\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-01T14:49:22.592Z\", \"dateReserved\": \"2026-08-30T17:30:01.406Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-09-01T02:08:46.189Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.