Ash Framework before version 3.22.0 contains an uncontrolled resource consumption vulnerability (CWE-400) in the function Ash.Type.Module.cast_input/2. This function unconditionally creates new Erlang atoms from any user-supplied binary string starting with "Elixir." via Module.concat([value]) before checking if the module exists. Because the BEAM VM's atom table is limited in size and atoms are never garbage collected, an attacker can exhaust the atom table by submitting many such inputs to any resource attribute or argument of type :module. This leads to a crash of the BEAM VM and denial of service of the application. The vulnerability is tracked as CVE-2026-34593 with a CVSS 4.0 score of 8.2 (high severity). The issue is patched in Ash Framework version 3.22.0.

An attacker able to submit crafted inputs to any resource attribute or argument of type :module can cause uncontrolled creation of Erlang atoms, exhausting the BEAM VM atom table. This results in a denial of service by crashing the entire BEAM VM and taking down the application. There is no indication of code execution or data leakage from the provided data.

Upgrade to Ash Framework version 3.22.0 or later, where this vulnerability has been patched. No other mitigation is indicated or required according to the vendor advisory.