ash-project ash_paper_trail up to 0.6.x FullDiff array allocation of resources

Summaryinfo

A vulnerability was found in ash-project ash_paper_trail up to 0.6.x. It has been rated as problematic. This affects an unknown function of the component FullDiff. This manipulation of the argument array causes allocation of resources. This vulnerability is registered as CVE-2026-77831. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability has been found in ash-project ash_paper_trail up to 0.6.x and classified as problematic. Affected by this vulnerability is an unknown function of the component FullDiff. The manipulation of the argument array with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect availability. The summary by CVE is:

Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use. With full-diff change tracking, AshPaperTrail.ChangeBuilders.FullDiff.ListChange pairs each prior array element against the new list by rebuilding the remaining-elements accumulator with acc ++ [tuple] on every step, copying the growing list each time, so the pairing scales cubically in the array length. Nothing bounds the length and the value comes straight from action input, so one request carrying a large accepted {:array, _} attribute forces tens of seconds of CPU and multi-gigabyte allocations. This issue affects ash_paper_trail: from 0.1.1 before 0.7.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-77831 since 08/27/2026. The exploitation appears to be easy. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 0.7.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash_paper_trail

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6

Website

• Product: https://github.com/ash-project/ash_paper_trail/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion