Uncontrolled Resource Consumption in Ash Project by Ash

CVE-2026-69659

What is CVE-2026-69659?

A vulnerability in the Ash Project allows attackers to exploit the deserialization of client-supplied pagination cursors. This vulnerability enables an attacker to create a crafted cursor that can exhaust the memory resources of the node. The issue arises from the deserialization process in decode_values/2, where the size of the input is not adequately bounded. As a result, small cursor inputs can trigger significant memory allocation due to the Erlang term format's ability to handle zlib-compressed payloads. This oversight, combined with concurrent requests, can lead to severe memory consumption and potential service downtime. Affected versions of Ash range from 1.17.0 to 3.31.1. It is crucial for users to update to the patched versions to mitigate this risk.

References