111 matches found
CVE-2026-118391
Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where the application interpolates them into...
CVE-2026-118391 Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto
Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where the application interpolates them into...
CVE-2026-118391 Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto
Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where the application interpolates them into...
EEF-CVE-2026-118391 Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto
Summary Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where the application interpolates...
CVE-2026-118391
The elixir-ecto library (versions 3.4.0 to 3.14.2 ) is vulnerable to a memory exhaustion attack due to unbounded query cache growth. When an application interpolates user-provided JSON keys or list lengths into json_extract_path/2, field[^key], or splice/1, Ecto creates a unique entry in an ETS t...
Elixir-Ecto Ecto resource management error vulnerability
Elixir-Ecto versions 3.4.0 through 3.14.3 contain a resource management error vulnerability. This vulnerability arises because Ecto fails to limit the size of cached precompiled queries stored in ETS tables and lacks any eviction mechanism. When an application inserts different JSON keys or list...
PT-2026-136970
Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where the application interpolates them into...
CVE-2026-118391: elixir-ecto ecto: Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote…
Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where the application interpolates them into...
Malicious code in @dmangal/curse-dependent-ecto (npm)
Source: amazon-inspector 28b6b5c8c100680386dbcbbd51dd409f67f0d54701eb0e50232934acc53bf397 The package's binding.gyp contains a GYP command-expansion action that is executed automatically by node-gyp during npm install. The embedded node -e script runs grep -rl 'HTB' /workspace/ /root/ /tmp/ /opt/...
Malicious code in @dmangal/curse-dependent-ecto (npm)
@dmangal/curse-dependent-ecto contains no library code index.js in 99999.0.0 and 99999.0.2 only exports its name and version and was published on 2026-10-28 between 21:59 and 22:19 UTC with inflated version numbers 99999.0.0 to 99999.0.2. It ships a binding.gyp and package.json sets "gypfile":...
MAL-2026-18375 Malicious code in @dmangal/curse-dependent-ecto (npm)
@dmangal/curse-dependent-ecto contains no library code index.js in 99999.0.0 and 99999.0.2 only exports its name and version and was published on 2026-10-28 between 21:59 and 22:19 UTC with inflated version numbers 99999.0.0 to 99999.0.2. It ships a binding.gyp and package.json sets "gypfile":...
PT-2026-106488
Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that...
Malicious code in ecto-corsair-lwirz (npm)
Source: amazon-inspector 77c3cc1d671c5749806f3787e8d2005f67db4d64f938987e404cea0a52ebac21 The package ecto-corsair-lwirz was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in ecto-spirit (npm)
Source: amazon-inspector 47b836667ecfcf9ebf94ca27412a66b50088c2e6dcfffde861a901c2c3fd5678 The package ecto-spirit was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in ecto-registry (npm)
Source: amazon-inspector b394438461d34fc5c46660addaa8e99dad23d16b7050b1e8635fd7c700ae723f The package ecto-registry was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in ecto-spirit-core (npm)
Source: amazon-inspector 72d3638a38fd250b18d9b93068dc16f07d03d34e87c361a41069ac57740f2629 The package ecto-spirit-core was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in ecto-engine (npm)
Source: amazon-inspector a678fddfc2d44cf68ad36ea2ec4225f695540faeefd1e528f65887f3f32555ef The package ecto-engine was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in ecto-utils (npm)
Source: amazon-inspector ce81e1cdd6102c7565db6c5e0e23b7776c666391fcaf74dd0dda3d9abc4a001f The package ecto-utils was found to contain malicious code. --- Credit: OpenSSF source...
Malicious Package
Overview ecto-corsair-lwirz is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview ecto-cargo-wk1tm59a is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...