EUVD-2026-54937Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Cursor arrives via HTTP query parameter on network-accessible endpoints; no credentials required on public APIs; pure availability impact with no confidentiality or integrity effect.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor.
Read actions with keyset pagination deserialize the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex, which base64-decodes the value and passes it to :erlang.binary_to_term/2 without bounding its size. The Erlang external term format supports zlib-compressed payloads, which the decoder inflates transparently, so a cursor of a few kilobytes can allocate tens of megabytes of heap in a single call. Ash itself only ever encodes cursors uncompressed, so the decoder accepts a term shape its encoder never produces. Concurrent requests aggregate these allocations and can terminate the node.
This issue affects ash: from 1.17.0 before 3.31.1.
AnalysisAI
Memory exhaustion via decompression bomb in Ash Framework's keyset pagination can terminate Erlang nodes running versions 1.17.0 through 3.31.0. The decode_values/2 function in lib/ash/page/keyset.ex deserializes client-supplied page[:after] or page[:before] cursors using :erlang.binary_to_term/2 without rejecting compressed Erlang external term format payloads or bounding the deserialized size, allowing a cursor of a few kilobytes on the wire to inflate to tens of megabytes of heap per request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the targeted application uses Ash with at least one resource configured for keyset pagination (e.g., `pagination keyset?: true` in a read action definition). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The primary risk signal is complete Erlang node availability loss: a single call to `binary_to_term` on a crafted cursor can allocate tens of megabytes, and concurrent requests aggregate allocations until OOM-kill or BEAM crash. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker targeting a Phoenix application with a public paginated Ash resource constructs a 2-million-element integer list, serializes it with `:erlang.term_to_binary([List.duplicate(0, 2_000_000)], [{:compressed, 9}])`, base64-encodes the roughly 8 KB result, and submits it as the `page[after]` query parameter on any keyset-paginated read action. Each request inflates to tens of megabytes of BEAM heap; a small pool of concurrent connections exhausts available memory and crashes the Erlang node. … |
| Remediation | Upgrade ash to version 3.31.1 or later; the fix is in commit 1816b103af975221210478d61db20adcea700319 (https://github.com/ash-project/ash/commit/1816b103af975221210478d61db20adcea700319) and the advisory is at https://github.com/ash-project/ash/security/advisories/GHSA-j35q-v8h8-7mwq. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in the ash crate before 0.33.1 for Rust. Rated critical severity (CVSS 9.8), this vulnerability
Private argument injection in the Ash Elixir framework (versions 3.0.0 through 3.29.2) allows end users to set action ar
Query injection and oracle enumeration in Ash Framework (ash-project/ash) versions 1.52.0-rc.11 through pre-3.31.1 allow
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today