EUVD-2026-68286Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint with no complexity barrier; sole impact is availability via unbounded DB reads; no confidentiality or integrity impact.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read.
AshGraphql.Graphql.Resolver.query_complexity/3 multiplies child complexity by the requested page size only when the argument map contains :limit (offset pagination). Relay connections and keyset pagination use first and last, which never match that clause and fall through to the catch-all that returns child_complexity + 1. A nested relay query such as posts(first: 500) { edges { node { comments(first: 500) { ... } } } } therefore scores as trivially cheap while materializing the full fan-out, passing an Absinthe max_complexity cap that rejects the equivalent limit-based query. The fix adds first and last clauses clamped to the action's page size.
This issue affects ash_graphql: from 0.16.23 before 1.11.0.
AnalysisAI
AshGraphql's Absinthe complexity calculator undercounts nested Relay connection and keyset pagination queries, allowing unauthenticated clients to bypass any configured max_complexity cap and force unbounded database reads. Versions 0.16.23 through 1.10.x expose this flaw whenever a schema uses first/last-based pagination: a single crafted query such as posts(first: 500) { edges { node { comments(first: 500) { ... …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must hold simultaneously: (1) the application uses AshGraphql version 0.16.23 through 1.10.x; (2) the GraphQL schema exposes at least one Relay connection or keyset-paginated field (i.e., fields accepting `first` or `last` arguments); and (3) an Absinthe `max_complexity` limit is configured in the schema - without it, there is no guard to bypass, though unlimited queries were already possible in that case. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) scores 8.7 and accurately reflects the threat profile: no authentication, no special network position, no user interaction required, and high availability impact against both the application and database tier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_graphql to version 1.11.0 or later; this release adds explicit `first` and `last` clauses to `query_complexity/3` that multiply child complexity by the respective page size, closing the bypass for all pagination modes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ash Graphql
View allCross-tenant data disclosure in ash_graphql affects authenticated subscribers in multi-tenant deployments running versio
Internal Ash attribute and argument names leak through GraphQL error responses in ash_graphql 1.9.0 through 1.10.x, bypa
Relay node query crash in AshGraphql (ash_graphql 0.27.0 through 1.10.x) allows an unauthenticated remote caller to abor
GraphQL subscription payloads carrying unauthorized record data leak to authenticated subscribers in ash_graphql 1.4.0-1
Cross-session record leakage in ash_graphql's subscription batcher allows one subscriber's resolved GraphQL records to b
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today