EEF-CVE-2026-118391 Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto

Summary Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where the application interpolates...

CVE-2026-118391

The elixir-ecto library (versions 3.4.0 to 3.14.2 ) is vulnerable to a memory exhaustion attack due to unbounded query cache growth. When an application interpolates user-provided JSON keys or list lengths into json_extract_path/2, field[^key], or splice/1, Ecto creates a unique entry in an ETS t...

CVE-2026-118391: elixir-ecto ecto: Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote…

Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where the application interpolates them into...

PT-2026-136970

Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where the application interpolates them into...