{"vulnerability": "CVE-2026-8469", "sightings": [{"uuid": "efda3387-71ef-47fb-b4ac-6620c8365d99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8469", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmc7caqjxm2i", "content": "CVE-2026-8469 - Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook\nCVE ID : CVE-2026-8469\n \n Published : May 20, 2026, 1:35 p.m. | 39\u00a0minutes ago\n \n Description : Allocation of Resources Without Limits or Throttling vulnerability in phenixdig...", "creation_timestamp": "2026-05-20T15:18:56.520995Z"}, {"uuid": "e87e94eb-74a5-4341-a723-ca60facd5c08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-8469", "type": "published-proof-of-concept", "source": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q", "content": "", "creation_timestamp": "2026-05-20T11:02:18.000000Z"}, {"uuid": "3e960b0d-998a-4dd4-a35f-a2d8b6b4556f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8469", "type": "seen", "source": "https://gist.github.com/alon710/c5822daca832e3ff7c46650aefcc77c9", "content": "# CVE-2026-8469: CVE-2026-8469: Denial of Service via BEAM Atom Table Exhaustion in phoenix_storybook\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-06-09\n> **Full Report:** https://cvereports.com/reports/CVE-2026-8469\n\n## Summary\nAn unauthenticated Denial-of-Service (DoS) vulnerability exists in phoenix_storybook versions 0.2.0 through 1.0.11 due to allocation of resources without limits (CWE-770). The application dynamically converts user-supplied parameter keys to atoms, leading to BEAM Atom Table exhaustion and immediate virtual machine crash.\n\n## TL;DR\nUnauthenticated remote attackers can crash the entire Elixir application by exhausting the Erlang VM atom table via crafted websocket payloads targeting the storybook playground.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.2 (High)\n- **Exploit Status**: Proof-of-Concept\n- **Affected Versions**: >= 0.2.0, < 1.1.0\n- **Remediation**: Upgrade to version 1.1.0 or higher\n\n## Affected Systems\n\n- phoenix_storybook (Elixir Hex Package)\n- **phoenix_storybook**: >= 0.2.0, < 1.1.0 (Fixed in: `1.1.0`)\n\n## Mitigation\n\n- Upgrade phoenix_storybook to version 1.1.0 or higher\n- Implement strict authentication and authorization plugs on storybook routes\n- Configure the Erlang VM with larger atom table limits (+t) as a temporary measure\n\n**Remediation Steps:**\n1. Open the mix.exs file in the project root\n2. Update the phoenix_storybook entry to depend on '~> 1.1.0'\n3. Run 'mix deps.get' to fetch and resolve dependencies\n4. Recompile the application and execute automated tests to verify stability\n5. Deploy the updated build to production environments\n\n## References\n\n- [GitHub Security Advisory GHSA-833p-95jq-929q](https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q)\n- [Fix commit 96d524690af0fe197a49f60d18e564a620b9ef81](https://github.com/phenixdigital/phoenix_storybook/commit/96d524690af0fe197a49f60d18e564a620b9ef81)\n- [Erlang Ecosystem Foundation CVE CVE-2026-8469](https://cna.erlef.org/cves/CVE-2026-8469.html)\n- [OSV Vulnerability Entry EEF-CVE-2026-8469](https://osv.dev/vulnerability/EEF-CVE-2026-8469)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-8469) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-09T23:11:25.000000Z"}]}