Description
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolve_typed_struct_field/2 in lib/ash_typescript/rpc/field_processing/field_selector.ex looks a client-supplied field name up in the typed struct's reverse map and, when it finds no match, falls back to String.to_atom/1. Because this runs before any field-existence check, an unresolvable name mints a permanent atom rather than being rejected as unknown. Atoms are never garbage collected, so a request carrying many distinct names on a typed struct field grows the atom table until the VM aborts at its limit. This issue affects ash_typescript: from 0.11.0 before 0.18.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ash-project ash_typescript
Default version status: unaffected
0.11.0 to < 0.18.0affected
pkg:hex/ash_typescriptash-project ash_typescript
Default version status: unaffected
7c3d30896f2f9a54edea17e3787549776b1b288d to < 0ab5c83a7df28d51a6de1fb9b859a142b2b12919affected
pkg:github/ash-project/ash_typescript