CVE-2026-81319 - Unsafe deserialization of decrypted terms enables node DoS in AshCloak
Brief
CVE ID : CVE-2026-81319
Published : Aug. 30, 2026, 6:16 p. m.
- 2 hours, 58 minutes ago
Description : Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption.
AshCloak. Calculations. Decrypt decodes the decrypted binary with Ash. Helpers. non_executable_binary_to_term/1 without the :safe option, so atoms in the payload are interned during the decode and never garbage collected, and the term format's compressed form is inflated transparently. vault. decrypt! () is the only barrier and stops tampering only for an authenticated cipher.
Cloak also ships the unauthenticated AES.