Answer in brief
CVE-2026-81319 records a Unknown severity vulnerability in Unsafe deserialization of decrypted terms enables node DoS in AshCloak. The current sources do not mark it as known exploited. The current feed maps ash-project/ash_cloak (generic), ash-project/ash_cloak (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps ash-project/ash_cloak (generic), ash-project/ash_cloak (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| ash-project/ash_cloakgeneric | >=0.1.0 <0.4.0 | 0.4.0 |
| ash-project/ash_cloakgeneric | >=f1595a77fdfa9bfc672f84c2f77feb9e7bf895fc <1690f0a436efe3e7c11d70d74ff5a8ac0fdf6608 | 1690f0a436efe3e7c11d70d74ff5a8ac0fdf6608 |
Published upstream
Aug 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 30, 2026
Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypted binary with Ash.Helpers.non_executable_binary_to_term/1 without the :safe option, so atoms in the payload are interned during the decode and never garbage collected, and the term format's compressed form is inflated transparently. vault.decrypt!() is the only barrier and stops tampering only for an authenticated cipher. Cloak also ships the unauthenticated AES.CTR, whose ciphertext an attacker who knows their own plaintext can XOR into any same-length payload without the key, so an ordinary read of the forged column reaches the decoder. A few hundred kilobytes of distinct atoms exhausts the atom table, or a small compressed payload inflates to gigabytes. This issue affects ash_cloak: from 0.1.0 before 0.4.0.
Quoted source text, attributed separately from HOL analysis.