CVE-2026-69659 Details
Description
Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex, which base64-decodes the value and passes it to :erlang.binary_to_term/2 without bounding its size. The Erlang external term format supports zlib-compressed payloads, which the decoder inflates transparently, so a cursor of a few kilobytes can allocate tens of megabytes of heap in a single call. Ash itself only ever encodes cursors uncompressed, so the decoder accepts a term shape its encoder never produces. Concurrent requests aggregate these allocations and can terminate the node. This issue affects ash: from 1.17.0 before 3.31.1.
A vulnerability allowing uncontrolled resource consumption has been identified in the Ash framework, specifically in versions 1.17.0 prior to 3.31.1. This vulnerability arises from the deserialization of client-supplied keyset pagination cursors in read actions, which is handled by the 'decode_values/2' function in 'lib/ash/page/keyset.ex'. The deserialization process base64-decodes the cursor values and passes them to the Erlang function 'binary_to_term/2' without any size limitations. The Erlang term format allows for zlib-compressed data, which the decoder automatically inflates, leading to significant memory allocation. As a result, a small cursor can expand and consume large amounts of memory, potentially exhausting the node's resources. This issue can be exploited by sending crafted cursors that take advantage of the missing input validation, particularly through concurrent requests that amplify the memory consumption.
Users can update to Ash version 3.31.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ash-project/ash/security/advisories/GHSA-j35q-v8h8-7mwq | CISA-ADP | Vendor AdvisoryPatch |
| https://cna.erlef.org/cves/CVE-2026-69659.html | EEF | Third Party Advisory |
| https://github.com/ash-project/ash/commit/1816b103af975221210478d61db20adcea700319 | EEF | Patch |
| https://github.com/ash-project/ash/security/advisories/GHSA-j35q-v8h8-7mwq | EEF | Vendor AdvisoryPatch |
| https://osv.dev/vulnerability/EEF-CVE-2026-69659 | EEF | Third Party AdvisoryPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | EEF |
Affected Products
| Product | Versions |
|---|---|
| ash-hq ash framework | >= 1.17.0, < 3.31.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 18, 2026 | Initial Analysis | [email protected] |
| Aug 10, 2026 | CVE Modified | CISA-ADP |
| Aug 9, 2026 | New CVE Received | EEF |