Resource Exhaustion Vulnerability in Ecto by Elixir

CVE-2026-118391

What is CVE-2026-118391?

A resource exhaustion vulnerability exists in Elixir's Ecto framework, which may allow unauthenticated remote attackers to exhaust memory in both the application and its database server. By sending crafted requests with unique JSON keys or variable list lengths, attackers exploit the way Ecto interpolates these inputs into queries. This results in the unbounded caching of prepared queries in an ETS table, creating a new cache entry for every distinct input, leading to potential server memory exhaustion. As Ecto does not release this cached memory until the process is restarted, the vulnerability poses a significant risk for applications depending on specific query structures.

References