CVE-2019-16764 json
PowAssent is susceptible to denial of service attacks
published 2019-11-25 6 y ago modified 2026-07-08 4 mo ago also GHSA-368c-xvrv-x986 , GHSA-5653-437f-5hmc , EUVD-2022-1629
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 65%
- public exploits
- 0
- none known
Summary
The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks. In `PowAssent.Phoenix.AuthorizationController` a value is fetched from the user provided params, and `String.to_atom/1` is used to convert the binary value to an atom so it can be used to fetch the provider configuration value. This is unsafe as it is user provided data, and can be used to fill up the whole atom table of ~1M which will cause the app to crash.
Patch / fix
Exploit prediction
1.08% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:N/I:N/A:P |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hex | pow_assent | <0.4.4 |
0.4.4 |
Affected products
- pow-auth pow_assent
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/pow-auth/pow_assent/commit/026105eeecc0e3c2f807e7109e745ea93c0fd9cf
web, patch
-
github.com
/pow-auth/pow_assent/security/advisories/GHSA-368c-xvrv-x986
web, third-party-advisory
-
hex.pm
/packages/pow_assent
web, release-notes
-
erlang.org
/doc/efficiency_guide/commoncaveats.html#list_to_atom-1
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2019-16764
advisory
-
github.com
/pow-auth/pow_assent
package
Sources
- CVE List CVE-2019-16764
- GitHub Advisory GHSA-5653-437f-5hmc
- NVD CVE-2019-16764
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.