Intel

AIKIDO-2025-10135

hammer is vulnerable to Race Condition

Race Condition Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Mar 6, 2025

25

Low Risk

This Affects:

Elixirhammer
7.0.0 - 7.0.0
Fixed in 7.0.1
Are you affected? Scan for Free

TL;DR

Affected versions of this package are affected by a race condition when creating a key in Atomic backends, as it relies on ets.insert instead of ets.insert_new. This flaw allows multiple processes to insert the same key simultaneously, leading to data inconsistencies. An attacker could exploit this by sending concurrent requests to create the same key, resulting in overwritten entries, data corruption, or denial of service.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

hammer is vulnerable to Race Condition in versions 7.0.0 - 7.0.0.

How to fix this

Upgrade the hammer library to the patch version.