Threats affecting pkg:hex/ecto

CVE-2026-118391 is a high-severity vulnerability in elixir-ecto's ecto library versions from 3.4.0 up to but not including 3.14.3. It allows an unauthenticated remote attacker to exhaust memory in both the application and the connected database server by sending requests with distinct JSON keys or list lengths. This occurs because ecto caches prepared queries without limits or eviction, and each unique JSON path or list length creates a new cache entry and prepared statement that is never released until process restart.