AIKIDO-2026-637157
solid is vulnerable to Denial of Service (DoS)
75
CVE Score
High
Denial of Service (DoS)
TL;DR
The solid Liquid template engine renders for and tablerow loops that can iterate over range literals such as (1..1000000000). When resolving the loop source it eagerly calls Enum.to_list on the full range before the limit or offset parameters are applied, allocating one list element per integer in the range. Because for and tablerow are default, always-enabled tags reachable without authentication, rendering a short template with large range bounds can exhaust memory and take down the BEAM process. The fix keeps the range lazy so limit and offset apply in constant time without materializing the whole range.
How do I fix this?
Upgrade the solid library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you render Liquid templates whose for or tablerow range bounds can be influenced by untrusted input.
Package
Versions
0.0.1 - 1.3.2
Fixed in 1.3.3Background info
solid is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 1.3.2.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.