{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0.1.0"
              },
              {
                "fixed": "1.3.1"
              }
            ],
            "source": [
              "DESCRIPTION",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "d99db5e821f4eebd45b96a4ed169f949d43b69d6"
            },
            {
              "fixed": "91da87c1c23cd6199ba1b0a1c8849a4c605130cc"
            },
            {
              "fixed": "731dffa09416d68f4ad3a0b6ee146b285ca0083b"
            }
          ],
          "repo": "https://github.com/ash-project/ash_admin",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-wcr6-9rrw-5jhv"
  ],
  "database_specific": {
    "cna_assigner": "EEF",
    "cwe_ids": [
      "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82722.json",
    "unresolved_ranges": [
      {
        "extracted_events": [
          {
            "introduced": "98b03baa8422b94dd13e305bf08b8ee3f7232c7b"
          },
          {
            "fixed": "731dffa09416d68f4ad3a0b6ee146b285ca0083b"
          }
        ],
        "source": "AFFECTED_FIELD"
      }
    ]
  },
  "details": "Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node.\n\nTwo LiveView event handlers interned atoms from unvalidated client input: AshAdmin.PageLive's set_actor built modules from the resource/domain payload with Module.concat/1, and AshAdmin.Components.Resource.Show's calculate converted every submitted form key with String.to_atom/1. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted resource/domain against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned.\n\nThis issue affects ash_admin: from 0.1.0 before 1.3.1.",
  "id": "CVE-2026-82722",
  "modified": "2026-09-01T03:30:16.008834157Z",
  "published": "2026-08-31T02:22:15.099Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-82722.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82722"
    },
    {
      "type": "WEB",
      "url": "https://repo.hex.pm"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82722.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-wcr6-9rrw-5jhv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82722"
    },
    {
      "type": "FIX",
      "url": "https://github.com/ash-project/ash_admin/commit/731dffa09416d68f4ad3a0b6ee146b285ca0083b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ash-project/ash_admin"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)"
}