CVE-2026-74837

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.convert_to_field_atom/2 in lib/ash_typescript/field_formatter.ex converts a client-supplied field name to an atom with String.to_atom/1 when no matching atom already exists. It delegates first to parse_input_field/2, which resolves the name with String.to_existing_atom/1 and falls back to returning the plain string; convert_to_field_atom/2 then mints an atom from that string rather than treating the name as unknown. RPC field selection reaches it for every requested field name through AshTypescript.Rpc.FieldProcessing.FieldSelector, which resolves each name before checking that the field exists, with no allowlist, length bound, or rate limit. Atoms are never garbage collected, so each distinct name mints a permanent one and the VM aborts once the atom table limit is reached. A field name over 255 characters additionally raises an uncaught SystemLimitError. This issue affects ash_typescript: from 0.1.0 before 0.18.0.

• CWE-770

• https://cna.erlef.org/cves/CVE-2026-74837.html
• https://github.com/ash-project/ash_typescript/commit/df95df4b9afdca5e5bbce32dbd566ccc49a7f14b
• https://github.com/ash-project/ash_typescript/security/advisories/GHSA-mhxc-mhqx-3v28
• https://osv.dev/vulnerability/EEF-CVE-2026-74837
• https://github.com/ash-project/ash_typescript/security/advisories/GHSA-mhxc-mhqx-3v28

Published

Sep 1, 2026

Last Modified

Sep 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7481GitLab has remediated an issue in GitLab EE affecting all ve…5.4
• CVE-2026-7482Ollama before 0.17.1 contains a heap out-of-bounds read vuln…9.1
• CVE-2026-74820ServiceNow has remediated a SQL injection vulnerability that…10
• CVE-2026-7483Local privilege escalation potentially allowed an attacker t…8.5
• CVE-2026-74835The inets application HTTP server httpd fails to enforce a c…8.7
• CVE-2026-74836Allocation of Resources Without Limits or Throttling vulnera…8.7
• CVE-2026-7484External control of Assumed-Immutable web parameter vulnerab…5.3
• CVE-2026-74842A vulnerability was found in Kira-Pgr PromptShopMCP up to 5b…6.3
• CVE-2026-74843A vulnerability was determined in Wavlink WN531P3 and WN535M…10
• CVE-2026-74845Official Document Management System developed by 2100 Techno…8.8
• CVE-2026-74848Inconsistent Interpretation of HTTP Requests ('HTTP Request/…7.5
• CVE-2026-74849Zohocorp ManageEngine ADSelfService Plus versions before bui…9.8