CVE-2026-77831
Received Received - Intake

Denial of Service in ash_paper_trail via Inefficient Algorithmic Complexity

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: EEF

Description
Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use. With full-diff change tracking, AshPaperTrail.ChangeBuilders.FullDiff.ListChange pairs each prior array element against the new list by rebuilding the remaining-elements accumulator with acc ++ [tuple] on every step, copying the growing list each time, so the pairing scales cubically in the array length. Nothing bounds the length and the value comes straight from action input, so one request carrying a large accepted {:array, _} attribute forces tens of seconds of CPU and multi-gigabyte allocations. This issue affects ash_paper_trail: from 0.1.1 before 0.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-77831
EUVD
EUVD-2026-68144

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_paper_trail From 0.1.1 (inc) to 0.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an inefficient algorithmic complexity issue in the ash_paper_trail library. It occurs when a user submits a large array attribute during a create or update action with full-diff change tracking enabled. The system inefficiently rebuilds a list by repeatedly copying it, causing cubic time complexity (O(n³)) and excessive CPU and memory usage, leading to a denial of service.

Detection Guidance

To detect this vulnerability, monitor for unusually high CPU and memory usage during create or update actions involving large array attributes in systems using ash_paper_trail versions 0.1.1 to 0.7.0. Check logs for requests with large array payloads in actions with full-diff change tracking enabled.

Impact Analysis

An attacker could exploit this by sending a request with a very large array, causing your system to consume excessive CPU and memory. This may slow down or crash your application, making it unavailable for legitimate users. The impact is primarily on system availability.

Compliance Impact

This vulnerability primarily impacts system availability by causing excessive CPU and memory use, leading to potential denial of service. It does not directly affect confidentiality or integrity of data. Compliance with standards like GDPR or HIPAA may be indirectly impacted if the denial of service disrupts access to personal or health data, potentially violating availability requirements. However, the vulnerability itself does not lead to unauthorized data access or disclosure.

Mitigation Strategies

Immediately upgrade ash_paper_trail to version 0.7.0 or later. Disable full-diff change tracking if not required or restrict array attribute sizes in exposed actions to prevent unbounded input.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77831. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart