EUVD-2026-68144Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Action input is typically network-submitted in Ash deployments; AC:H for required full-diff configuration; A:H because tens-of-seconds CPU saturation constitutes a complete availability loss per request.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use.
With full-diff change tracking, AshPaperTrail.ChangeBuilders.FullDiff.ListChange pairs each prior array element against the new list by rebuilding the remaining-elements accumulator with acc ++ [tuple] on every step, copying the growing list each time, so the pairing scales cubically in the array length. Nothing bounds the length and the value comes straight from action input, so one request carrying a large accepted {:array, _} attribute forces tens of seconds of CPU and multi-gigabyte allocations.
This issue affects ash_paper_trail: from 0.1.1 before 0.7.0.
AnalysisAI
Cubic-complexity denial of service in ash_paper_trail's full-diff list change builder allows any user permitted to invoke a paper-trailed Ash action with an accepted array attribute to exhaust backend CPU and memory. Versions 0.1.1 through 0.6.x are affected; the root cause is an O(n³) list accumulation pattern in AshPaperTrail.ChangeBuilders.FullDiff.ListChange where unbounded action input directly drives allocation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must simultaneously hold: (1) the targeted Ash resource must be configured with full-diff change tracking enabled - this is a non-default, explicitly configured mode in ash_paper_trail and is the primary limiting factor; (2) the resource's create or update action must accept at least one attribute typed as `{:array, _}` with no server-enforced length cap; and (3) the attacker must have permission to invoke that specific action - the CVSS PR:N rating indicates no formal authentication is required, but Ash Framework action policies may restrict access in practice. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score of 2.1 (AV:L/AC:L/AT:P/PR:N/UI:N/VA:L) reflects a narrow local-only threat model and low availability impact, but the description indicates the triggering input arrives via an application action - which in Ash Framework deployments is frequently exposed over a network interface (GraphQL, REST, or Phoenix LiveView). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_paper_trail to version 0.7.0 or later; the patch (commit e781f5d8840b07d57db99f9a4728298837d7b3a8) replaces the quadratic list accumulation with O(1) prepend followed by O(n) reversal, eliminating the vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ash Paper Trail
View allCleartext exposure of nested sensitive fields in Ash Paper Trail audit logs (versions 0.3.0-0.6.x) allows any principal
Cleartext storage of sensitive Ash resource attributes in AshPaperTrail versions 0.1.1 through 0.6.x allows any actor wi
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today