$ the-wire · showcase
Ecto stops caching interpolated JSON paths and splices
By RepoJournal · Filed · About Elixir & Phoenix · Composed from the cited sources · methodology
3 people shipped this
Ecto closed a memory exhaustion denial of service by making queries with interpolated JSON paths, splice lists, and constants uncacheable, while Live View cut redundant static resolution during comprehension-to-iodata conversion.
Do not cache queries with interpolated JSON paths, splices, and constants elixir-ecto/ecto
José Valim's change stops inlining interpolated JSON path elements into the query expression and stores them as parameters the planner inlines instead; combined with the splice-length and constant cases, those queries are now uncacheable, as `in` lists already were. That is the fix for CVE-2026-118391, where each distinct path or spliced-list length minted a fresh cache entry until memory ran out.
Unbounded query cache growth from interpolated JSON paths and splice lists enables memory exhaustion denial of service elixir-ecto/ecto
The advisory behind the patch: unbounded query cache growth from interpolated JSON paths and splice lists enables memory exhaustion denial of service. Any code taking a JSON path or list length from user input and feeding it to Ecto was generating a new cache entry per distinct value.
Resolve comprehension statics once during iodata conversion phoenixframework/phoenix_live_view
Converting a comprehension to iodata used to repeat the same static-template resolution for every row; the statics are now resolved once before traversing a nonempty comprehension and the row serializer is called directly. The helper `to_iodata_parts/5` is inlined and removed, so the diff also touches every remaining call site of that function.
Keep the data type through Changeset functions elixir-ecto/ecto
`Ecto.Changeset.t/1` takes the type of its data, but most changeset functions were specced with the bare `t()`, so a `t(MySchema.t())` widened at the first call and Dialyzer and eqWAlizer lost the schema type; `apply_changes/1` returned `Ecto.Schema.t() | data`. The specs now carry the data type through. Typechecking-only, no runtime change.
Remove redundant escape/5 clause elixir-ecto/ecto
Also in Ecto: an `escape/5` clause that earlier clauses had already shadowed was removed, clearing the redundant-clause compiler warning, and CI was fixed.
Action items
- → Upgrade ecto to the release containing the CVE-2026-118391 fix before your next deploy elixir-ecto/ecto [immediate]
