AshPaperTrail CVE-2026-77831

Three conditions must simultaneously hold: (1) the targeted Ash resource must be configured with full-diff change tracking enabled - this is a non-default, explicitly configured mode in ash_paper_trail and is the primary limiting factor; (2) the resource's create or update action must accept at least one attribute typed as {:array, _} with no server-enforced length cap; and (3) the attacker must have permission to invoke that specific action - the CVSS PR:N rating indicates no formal authentication is required, but Ash Framework action policies may restrict access in practice. What limits exploitation: deployments using simplified diff, no-diff, or default tracking modes are entirely unaffected; Ash action policies that require authentication or role-based authorization reduce the attacker pool; and deployments where actions are not exposed over a network interface reduce the attack surface to local or internal users only. The vendor-assigned AV:L vector implies a local-only threat model - teams should independently verify whether their application exposes vulnerable actions over a network.

The vendor-assigned CVSS 4.0 score of 2.1 (AV:L/AC:L/AT:P/PR:N/UI:N/VA:L) reflects a narrow local-only threat model and low availability impact, but the description indicates the triggering input arrives via an application action - which in Ash Framework deployments is frequently exposed over a network interface (GraphQL, REST, or Phoenix LiveView). If actions are network-accessible, the effective attack vector is AV:N, materially elevating real-world risk beyond the vendor score. AT:P correctly captures that full-diff change tracking must be configured; deployments not using full-diff mode are entirely unaffected. The impact is not merely VA:L: the description states 'tens of seconds of CPU and multi-gigabyte allocations' per request, which constitutes a complete temporary denial of service on the affected process. No EPSS data was provided; given ash_paper_trail's niche footprint, broad opportunistic exploitation is unlikely, but targeted abuse by a malicious authenticated user is straightforward. No KEV listing and no public exploit code identified at time of analysis. Priority should be high for deployments where full-diff mode is active and array-type attributes are accepted on publicly or semi-publicly accessible actions.

A user with permission to invoke a paper-trailed Ash create or update action submits a POST request carrying an array attribute populated with thousands of elements - no special tooling required, only a standard HTTP client. The ListChange builder begins O(n³) pairing work, holding CPU at near-100% for tens of seconds and allocating multiple gigabytes of heap, rendering the BEAM process unresponsive to concurrent requests until the computation completes or the process is killed. No public proof-of-concept code has been identified, but the attack is trivially constructable from the public description alone.