An allocation of resources vulnerability in the ash_admin LiveView component allows authenticated attackers to trigger a denial of service by exhausting the BEAM atom table.

The vulnerability exists within the AshAdmin.PageLive and AshAdmin.Components.Resource.Show event handlers, which improperly convert unvalidated client input into atoms. Because atoms are not garbage collected in the BEAM virtual machine, an authenticated user can flood these handlers to exhaust the atom table, forcing the node to abort.

The exploitation of this flaw leads to a complete denial of service for the affected node, resulting in significant system downtime and potential disruption of dependent applications. With a CVSS score of 8.3, the vulnerability is classified as High severity, reflecting the ease of execution and the catastrophic impact on service availability.

Immediate Action: Update the ash_admin dependency to version 1.3.1 or later to ensure all user input is properly validated against declared resources and arguments.

Proactive Monitoring: Monitor system logs for unusual spikes in memory usage or repeated node crashes that correlate with access to the ash_admin LiveView endpoints.

Compensating Controls: Restrict access to the ash_admin interface to trusted administrative networks or utilize a Web Application Firewall to filter requests that exhibit patterns consistent with automated atom-generation attacks.

Public Exploit Available: No (exploit_available: false)

Given the ease with which this vulnerability can be leveraged to cause a total service outage, organizations using ash_admin must prioritize updating to version 1.3.1 immediately. The lack of public exploits does not mitigate the risk, as the mechanism for exploitation is well-documented within the security advisory.