Ecto query cache grows without limit, exhausting memory
Elixir database tool can be stalled by crafted web requests.
Summary
The Elixir data library Ecto keeps adding memory for each distinct JSON key or list length in requests, which can stall servers. An unauthenticated remote attacker can trigger it; versions from 3.4.0 before 3.14.3 are affected.
Affected when
- code that passes request data into a JSON path or a splice/1 list in a query
- default query_cache: true setting when running the query
What to do
Update to ecto 3.14.3. Until then, validate request values, or run the query with query_cache: false.
Can't update yet?
Add this line to the config file:
Repo.all(query, query_cache: false)
A wrong setting can stop the service or lock you out. Check the source links below first.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- Write-up: ecto.hexdocs.pm (opens in a new tab) · ecto.hexdocs.pm (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen