Resource Exhaustion in ash_authentication_oauth2_server by Ash Project

CVE-2026-82753

What is CVE-2026-82753?

The ash_authentication_oauth2_server is susceptible to resource exhaustion due to an allocation of resources without any imposed limits. Unauthenticated attackers can exploit this flaw via the /authorize endpoint, which allows fetching and upserting client rows without constraint. The system does not limit the number of rows created, leading to unregulated consumption of database storage and memory. Attackers can leverage this by providing valid documents from numerous distinct URLs, causing the server to create a permanent client row for each URL. This results in excessive storage and memory usage, which can severely impact the performance and availability of the affected service. A patch has been developed to address this vulnerability.

References