EUVD-2026-68947Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector assigned because Ash filters are typically exposed through web API endpoints; AC:H reflects the required multi-to-many relationship configuration with large datasets; no confidentiality or integrity impact.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory.
Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its related rows. flatten_relationships/2 (lib/ash/filter/runtime.ex) eagerly built the full Cartesian product across the filter's to-many relationship paths, so a record with K to-many relationships of M rows each materialized on the order of M^K scenarios before any predicate was checked. A filter or dataset that reaches several sizeable to-many relationships therefore allocates memory combinatorially and can exhaust the node. The fix streams the expansion lazily and short-circuits on the first matching scenario, bounding the work.
This issue affects ash: from 1.29.0-rc0 before 3.32.2.
AnalysisAI
Memory exhaustion in Ash Framework's runtime filter engine allows an attacker controlling filter inputs to crash an Elixir node by submitting a query that spans multiple to-many relationships against large in-memory datasets. The vulnerable flatten_relationships/2 function in lib/ash/filter/runtime.ex (versions 1.29.0-rc0 through 3.32.2) eagerly materializes the full Cartesian product of related rows before evaluating any predicate, producing O(M^K) intermediate records for K relationships with M rows each. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that untrusted input reaches `Ash.Filter.Runtime.filter_matches/3` with a filter spanning at least two to-many relationship paths, and that the in-memory datasets for those relationships are large enough to trigger combinatorial memory growth - even two relationships with a few hundred rows each suffice. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 score of 5.9 Medium reflects a required attack condition (AT:P) - the presence of multiple to-many relationships with sizeable datasets - which materially limits the exploitable attack surface compared to an unconditional DoS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Ash to version 3.32.2 or later, which resolves the issue by replacing eager Cartesian product expansion with lazy streaming evaluation; the patch is documented at https://github.com/ash-project/ash/security/advisories/GHSA-mgwj-c69v-6f83 and commit https://github.com/ash-project/ash/commit/da07f009e889819ec410fa1f0f12534bfb9e21dd. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in the ash crate before 0.33.1 for Rust. Rated critical severity (CVSS 9.8), this vulnerability
Private argument injection in the Ash Elixir framework (versions 3.0.0 through 3.29.2) allows end users to set action ar
Persistent record-level denial of service in the ash Elixir resource framework (versions 3.6.3-3.32.1) lets any actor wh
Integer overflow in Ash Framework's vector encoding corrupts stored vectors in any Elixir application using Ash versions
CPU exhaustion in Ash Framework's string type constraint handler allows denial of service against Elixir applications th
Memory exhaustion via decompression bomb in Ash Framework's keyset pagination can terminate Erlang nodes running version
Silent record overwrite in Ash's ETS and Mnesia data layers allows any actor who can supply a primary key on a create ac
Record-level authorization bypass in Ash (ash-project) versions 3.4.44 through 3.32.1 silently leaks denied records to a
Incorrect authorization in ash-project/ash (Elixir data framework) versions 3.13.2 through 3.32.1 causes relationship sc
Authorization policy bypass in Ash (Elixir framework) versions 3.29.0-3.32.1 permits any application actor to modify rec
Unbounded string storage in Ash Framework versions 0.10.0 through 3.32.x allows unauthenticated attackers to bypass max_
Constraint bypass in Ash Framework's CiString type allows storing string values that violate configured length or match
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today