AIKIDO-2026-637157
solid is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
solidTL;DR
The solid Liquid template engine renders for and tablerow loops that can iterate over range literals such as (1..1000000000). When resolving the loop source it eagerly calls Enum.to_list on the full range before the limit or offset parameters are applied, allocating one list element per integer in the range. Because for and tablerow are default, always-enabled tags reachable without authentication, rendering a short template with large range bounds can exhaust memory and take down the BEAM process. The fix keeps the range lazy so limit and offset apply in constant time without materializing the whole range.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you render Liquid templates whose for or tablerow range bounds can be influenced by untrusted input.
Background info
solid is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 1.3.2.
How to fix this
Upgrade the solid library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant