CVE-2026-81319

Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypted binary with Ash.Helpers.non_executable_binary_to_term/1 without the :safe option, so atoms in the payload are interned during the decode and never garbage collected, and the term format's compressed form is inflated transparently. vault.decrypt!() is the only barrier and stops tampering only for an authenticated cipher. Cloak also ships the unauthenticated AES.CTR, whose ciphertext an attacker who knows their own plaintext can XOR into any same-length payload without the key, so an ordinary read of the forged column reaches the decoder. A few hundred kilobytes of distinct atoms exhausts the atom table, or a small compressed payload inflates to gigabytes. This issue affects ash_cloak: from 0.1.0 before 0.4.0.

• CWE-502

• https://cna.erlef.org/cves/CVE-2026-81319.html
• https://github.com/ash-project/ash_cloak/commit/1690f0a436efe3e7c11d70d74ff5a8ac0fdf6608
• https://github.com/ash-project/ash_cloak/security/advisories/GHSA-rc26-mrm2-6pf9
• https://osv.dev/vulnerability/EEF-CVE-2026-81319
• https://github.com/ash-project/ash_cloak/security/advisories/GHSA-rc26-mrm2-6pf9

Published

Aug 30, 2026

Last Modified

Sep 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-81302PALLET CONTROL products contain an incorrect default permiss…8.5
• CVE-2026-81303A flaw was found in hawtio-operator. The operator holds rout…6.3
• CVE-2026-8131A security flaw has been discovered in SourceCodester SUP On…7.3
• CVE-2026-81315Origin Validation Error vulnerability in ash-project ash_ai …7.4
• CVE-2026-81316Incorrect Authorization vulnerability in ash-project ash_sql…2.1
• CVE-2026-81318Incorrect Authorization vulnerability in ash-project ash_sql…2.1
• CVE-2026-8132A weakness has been identified in CodeAstro Leave Management…7.3
• CVE-2026-81320A flaw was found in hawtio-operator. When a custom Route TLS…5.5
• CVE-2026-81322Exposure of Sensitive Information to an Unauthorized Actor v…2.1
• CVE-2026-81326QND uses a hard-coded cryptographic key, which may allow a l…6.8
• CVE-2026-8133A security vulnerability has been detected in zyx0814 FilePr…7.3
• CVE-2026-81330The C6 ear camera transmits live video to the EarVision Andr…6.5