Uncontrolled Resource Consumption in Ash-Project's Ash Framework

CVE-2026-82743

What is CVE-2026-82743?

The Ash Framework, created by Ash-Project, is impacted by a vulnerability that allows for uncontrolled resource consumption. This occurs during asynchronous read operations, where the framework's Read.AsyncLimiter.await_at_least_one/1 function employs a non-blocking loop that inadvertently keeps a scheduler thread occupied at full CPU load. This busy-waiting mechanism leads to performance degradation, particularly in scenarios involving slow data retrieval or calculations. The correct approach, implemented in a subsequent patch, shifts to a method that relinquishes control and allows the process to sleep until resources become available. Users are encouraged to update their systems to versions 3.32.2 or later to mitigate this risk.

References