CVE-2026-69659
Received Received - Intake

Uncontrolled Resource Consumption in Ash Framework

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: EEF

Description
Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex, which base64-decodes the value and passes it to :erlang.binary_to_term/2 without bounding its size. The Erlang external term format supports zlib-compressed payloads, which the decoder inflates transparently, so a cursor of a few kilobytes can allocate tens of megabytes of heap in a single call. Ash itself only ever encodes cursors uncompressed, so the decoder accepts a term shape its encoder never produces. Concurrent requests aggregate these allocations and can terminate the node. This issue affects ash: from 1.17.0 before 3.31.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-09
Last Modified
2026-08-09
Generated
2026-08-09
AI Q&A
2026-08-09
EPSS Evaluated
N/A
NVD
CVE-2026-69659
EUVD
EUVD-2026-54937

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash From 1.17.0 (inc) to 3.31.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an uncontrolled resource consumption issue in the Ash framework's keyset pagination. Attackers can exploit it by sending crafted cursors that, when deserialized, consume excessive memory on the server. The cursors are base64-decoded and converted to Erlang terms without size limits, allowing compressed payloads to expand into much larger memory allocations. Multiple concurrent requests can exhaust node memory and crash the system.

Detection Guidance

To detect this vulnerability, monitor for unusually high memory usage during keyset pagination operations. Check logs for errors related to oversized cursors or invalid keyset errors in Ash applications. Use system monitoring tools like `htop` or `top` to observe memory consumption spikes during pagination requests.

Impact Analysis

If you use Ash framework versions 1.17.0 to 3.31.0 with keyset pagination enabled, an attacker could send specially crafted requests to exhaust server memory. This may cause system crashes, slow performance, or denial of service. The impact is higher in environments with many concurrent users or requests.

Compliance Impact

This vulnerability primarily impacts system availability due to memory exhaustion, which could lead to service disruptions. GDPR and HIPAA require maintaining system availability and protecting personal data. While this CVE does not directly expose data, prolonged downtime could violate availability requirements under these regulations.

Mitigation Strategies

Upgrade Ash to version 3.31.1 or later to apply the security patch. Configure the `max_keyset_byte_size` limit in your Ash application settings to a reasonable value (e.g., 10 KiB). Block or validate compressed payloads in keyset cursors to prevent decompression bomb attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69659. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart