Resource Exhaustion Vulnerability in Ash_Project Ash_Typescript
CVE-2026-74837

8.7HIGH

Key Information:

Vendor

Ash-project

Status
Ash Typescript
Vendor
CVE Published:
1 September 2026

What is CVE-2026-74837?

The Ash_Project's ash_typescript package contains a resource exhaustion vulnerability that allows unauthenticated attackers to exhaust the BEAM atom table. This is achieved through the conversion of client-supplied RPC field names into atoms, which are created without limits or throttling. The FieldFormatter's method can lead to the creation of an unbounded number of atoms as there is no proper validation or rate limiting in place, causing the system to abort when the atom table limit is reached. Any field name exceeding 255 characters will also raise an unhandled SystemLimitError. This issue affects versions of ash_typescript from 0.1.0 up to, but not including, 0.18.0.

Affected Version(s)

ash_typescript 0.1.0 < 0.18.0

ash_typescript 1a3d4c343430c8e4784acfcd33122a807fafa086

References

https://github.com/ash-project/ash_typescript/security/ad...
relatedvendor-advisory
https://cna.erlef.org/cves/CVE-2026-74837.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-74837
related

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Ullrich
Peter Ullrich
Torkild Gundersen Kjevik / Ash Project
Jonatan Männchen / EEF
.