Inefficient Algorithmic Complexity in ash_paper_trail from Ash Project

CVE-2026-77831

What is CVE-2026-77831?

The ash_paper_trail product from Ash Project suffers from an algorithmic inefficiency vulnerability. This allows an attacker to submit a large array attribute during create or update actions, which can trigger a denial of service by causing excessive CPU and memory consumption. Specifically, the full-diff change tracking method results in a cubic scaling of resource use as it repeatedly rebuilds accumulators for each element of the array, leading to significant slowdowns and potential service downtime.

References