CVE-2026-82742 in ash
Summary
by MITRE • 09/01/2026
Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory.
Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its related rows. flatten_relationships/2 (lib/ash/filter/runtime.ex) eagerly built the full Cartesian product across the filter's to-many relationship paths, so a record with K to-many relationships of M rows each materialized on the order of M^K scenarios before any predicate was checked. A filter or dataset that reaches several sizeable to-many relationships therefore allocates memory combinatorially and can exhaust the node. The fix streams the expansion lazily and short-circuits on the first matching scenario, bounding the work.
This issue affects ash: from 1.29.0-rc0 before 3.32.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified as an uncontrolled resource consumption flaw within the Ash framework specifically targets its filter runtime engine when processing complex data relationships. This security issue arises from a fundamental design inefficiency in how the system handles queries involving multiple to-many associations. When a developer defines a filter that spans several such relationships, the underlying implementation attempts to resolve these connections by generating all possible combinations of related records before evaluating any specific filtering predicates. This approach creates a significant performance bottleneck and introduces a severe availability risk for applications relying on this library.
The technical root cause lies in the behavior of the flatten_relationships function located within the Ash.Filter.Runtime module. Instead of processing relationships incrementally or lazily, the original implementation eagerly constructs the full Cartesian product across all to-many relationship paths defined in the filter. If a single record is associated with K distinct to-many relationships, and each relationship contains M related rows, the system attempts to materialize approximately M raised to the power of K scenarios into memory simultaneously. This exponential growth means that even moderately sized datasets can quickly consume vast amounts of RAM as the number of joined relationships increases.
From an operational perspective, this flaw allows a remote or local attacker who has access to query execution capabilities to trigger a denial of service condition. By crafting a filter request that targets multiple large to-many associations, an attacker can force the application node to allocate memory combinatorially until it exhausts available resources. This results in the crashing of the Erlang BEAM virtual machine process hosting the Ash framework instance, leading to service unavailability for all users connected to that node. The impact is particularly severe because it does not require authentication or complex exploitation techniques beyond constructing a specific query structure that triggers this expansion logic.
This vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as the application fails to properly control the allocation and retention of system resources during request processing. In terms of attack vectors, it relates to ATT&CK technique T1496, or Resource Hijacking, where an attacker consumes computational resources to degrade service availability rather than stealing data directly. The flaw is present in versions of Ash ranging from 1.29.0-rc0 up until version 3.32.2, affecting any deployment that utilizes complex filtering across multiple relational associations without proper resource limits or streaming mechanisms.
The resolution involves refactoring the relationship expansion logic to operate lazily rather than eagerly. By implementing a streaming approach, the system can evaluate predicates against related records one combination at a time instead of building the entire dataset in memory first. Furthermore, the fix introduces short-circuiting behavior that stops processing as soon as the first matching scenario is found. This optimization bounds the computational work and memory usage to be proportional to the number of matches rather than the total possible combinations, effectively mitigating the risk of memory exhaustion while maintaining query correctness for valid use cases.
Organizations using affected versions should prioritize upgrading to version 3.32.2 or later immediately if they utilize Ash framework features involving complex relational filtering. For those unable to upgrade instantly, implementing rate limiting on filter queries and monitoring node memory usage can provide partial mitigation by detecting abnormal spikes in resource consumption associated with such requests. Additionally, reviewing application code for filters that join multiple large tables allows developers to refactor these queries into simpler structures or use database-level joins where the query optimizer may handle combination logic more efficiently than the framework's runtime expansion mechanism.