CVE-2026-69659 in ash
Summary
by MITRE • 08/09/2026
Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor.
Read actions with keyset pagination deserialize the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex, which base64-decodes the value and passes it to :erlang.binary_to_term/2 without bounding its size. The Erlang external term format supports zlib-compressed payloads, which the decoder inflates transparently, so a cursor of a few kilobytes can allocate tens of megabytes of heap in a single call. Ash itself only ever encodes cursors uncompressed, so the decoder accepts a term shape its encoder never produces. Concurrent requests aggregate these allocations and can terminate the node.
This issue affects ash: from 1.17.0 before 3.31.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/09/2026
The vulnerability under analysis represents an uncontrolled resource consumption flaw in the ash-project ash framework, specifically targeting memory exhaustion through crafted keyset pagination cursors. This security weakness exists within the decode_values/2 function located in lib/ash/page/keyset.ex, where client-supplied pagination parameters are processed without adequate size limitations or validation. The vulnerability stems from the improper handling of base64-encoded cursor values that are subsequently passed to Erlang's :erlang.binary_to_term/2 function, which lacks any bounds checking on the decoded payload size.
The technical implementation of this flaw exploits the Erlang external term format's support for transparent zlib decompression capabilities. When an attacker supplies a malicious cursor containing compressed data, the binary_to_term function automatically inflates the payload without size constraints, allowing a small cursor of several kilobytes to trigger allocation of tens of megabytes of heap memory in a single operation. This behavior occurs because the ash framework only ever encodes cursors using uncompressed format, making the decoder susceptible to accepting maliciously crafted compressed terms that its own encoder would never generate.
The operational impact of this vulnerability is severe and can lead to complete system exhaustion and service disruption. The vulnerability manifests through memory allocation patterns that can be amplified by concurrent requests, where multiple attackers can simultaneously submit malicious cursors to aggregate heap allocations. This cumulative effect can quickly exhaust available memory resources on the target node, potentially causing process termination, system instability, or denial of service conditions. The vulnerability affects ash versions from 1.17.0 through 3.31.0, representing a substantial portion of the framework's release history and indicating this issue has persisted for an extended period.
From a cybersecurity perspective, this vulnerability maps to CWE-400 (Uncontrolled Resource Consumption) and aligns with ATT&CK technique T1499.004 (Endpoint Denial of Service) in its exploitation methods. The attack vector specifically targets the application layer through API pagination mechanisms, making it particularly dangerous as it can be exploited by unauthorized users without requiring elevated privileges or complex attack chains. Organizations using ash frameworks in production environments are advised to implement immediate mitigations including cursor size validation, memory allocation limits, and input sanitization measures to prevent exploitation of this vulnerability.
The root cause analysis reveals a fundamental design flaw in the framework's deserialization process where trust is placed in client-supplied data without proper bounds checking or format validation. This pattern demonstrates the importance of implementing defense-in-depth strategies that validate all external inputs against expected formats and sizes, particularly when processing encoded binary data through language-specific serialization functions. The vulnerability serves as a critical reminder of the need for secure deserialization practices and proper resource management in distributed applications handling user-supplied pagination parameters.
Mitigation strategies should include immediate patching to versions 3.31.1 or later where this vulnerability has been addressed, implementing input validation for cursor sizes before processing, adding memory limits to term decoding operations, and monitoring for unusual heap allocation patterns in affected systems. Additionally, organizations should consider implementing rate limiting and request size controls for pagination endpoints as part of their broader security posture improvements. The vulnerability highlights the necessity of regular security assessments and code reviews focusing on deserialization processes and resource consumption patterns within application frameworks that handle user-provided data structures.