CVE-2026-82742
Received Received - Intake

Uncontrolled Resource Consumption in Ash Framework

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its related rows. flatten_relationships/2 (lib/ash/filter/runtime.ex) eagerly built the full Cartesian product across the filter's to-many relationship paths, so a record with K to-many relationships of M rows each materialized on the order of M^K scenarios before any predicate was checked. A filter or dataset that reaches several sizeable to-many relationships therefore allocates memory combinatorially and can exhaust the node. The fix streams the expansion lazily and short-circuits on the first matching scenario, bounding the work. This issue affects ash: from 1.29.0-rc0 before 3.32.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-82742
EUVD
EUVD-2026-68947

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash From 1.29.0-rc0 (inc) to 3.32.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Ash framework allows an attacker to exhaust system memory by crafting a filter that spans multiple to-many relationships. The system generates a combinatorial Cartesian product of related rows before evaluating any conditions, causing memory usage to grow exponentially with the number of relationships.

Detection Guidance

Monitor for high memory usage or node crashes when processing filters with multiple to-many relationships. Check Ash framework logs for excessive resource consumption during filter operations. Use system monitoring tools like top, htop, or ps to observe memory spikes during filter-heavy operations.

Impact Analysis

An attacker could crash the system by consuming excessive memory, leading to a denial of service. This affects applications using Ash framework versions 1.29.0-rc0 to 3.32.1, especially those exposing user-supplied filters or handling large datasets with multiple relationships.

Mitigation Strategies

Upgrade the Ash framework to version 3.32.2 or later to apply the patch. Review and restrict user-supplied filters to limit to-many relationship traversals. Implement rate limiting on filter requests to prevent resource exhaustion. Monitor system performance after upgrades to ensure stability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82742. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart