CVE-2026-82742: Ash-Project Ash DOS Vulnerability

CVE-2026-82742 Overview

CVE-2026-82742 is an uncontrolled resource consumption vulnerability [CWE-400] in the ash-project/ash Elixir framework. The flaw resides in Ash.Filter.Runtime, which matches filters against in-memory records by expanding related rows. The flatten_relationships/2 function in lib/ash/filter/runtime.ex eagerly built the full Cartesian product of to-many relationship paths before evaluating any predicate. An attacker who can trigger a filter spanning multiple sizeable to-many relationships forces the node to allocate memory combinatorially on the order of M^K scenarios. This memory exhaustion can crash the Erlang/BEAM node hosting the application. The issue affects ash from version 1.29.0-rc0 before 3.32.2.

Critical Impact
An attacker can exhaust node memory and cause a denial of service by submitting a filter that traverses multiple to-many relationships against records with many related rows.

Affected Products

ash-project/ash Elixir framework versions 1.29.0-rc0 through 3.32.1
Applications relying on Ash.Filter.Runtime for in-memory filter matching
Fixed in ash version 3.32.2

Discovery Timeline

2026-09-01 - CVE-2026-82742 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82742

Vulnerability Analysis

The ash framework provides a declarative data layer for Elixir applications, including runtime filter evaluation against in-memory records. When a filter references relationship paths, Ash.Filter.Runtime must consider each combination of related rows to determine whether the parent record matches. The pre-patch implementation materialized every combination upfront rather than evaluating scenarios one at a time. This design choice turned a linear filter operation into a combinatorial one whenever multiple to-many relationships were involved.

Root Cause

The root cause is eager Cartesian product construction inside flatten_relationships/2 in lib/ash/filter/runtime.ex. For a record with K to-many relationships containing M rows each, the function allocated approximately M^K scenario tuples before any predicate was tested. No bounds check, streaming, or short-circuit logic gated this expansion. Memory pressure grew exponentially with the number of relationship paths in the filter and the size of each associated collection.

Attack Vector

Exploitation requires the ability to submit a filter (or influence data shape) that spans several to-many relationships against a record whose associations contain a moderate number of rows. The attack vector is local per the assigned CVSS 4.0 metrics, but the practical exposure depends on whether the hosting application exposes filter construction to untrusted callers through APIs, GraphQL, or JSON:API endpoints. A successful attack allocates memory until the BEAM node runs out and terminates, resulting in denial of service for all tenants on that node.

text

       |> Ash.Filter.relationship_paths()
 
     record
-    |> flatten_relationships(relationship_paths)
+    |> stream_relationships(relationship_paths)
     |> Enum.reduce_while({:ok, false}, fn scenario, {:ok, false} ->
       case do_match(
              scenario,

Source: GitHub Commit da07f00

The patch replaces flatten_relationships/2 with stream_relationships/2. Combined with the existing Enum.reduce_while/3, evaluation now short-circuits on the first matching scenario and lazily materializes combinations, bounding worst-case memory.

Detection Methods for CVE-2026-82742

Indicators of Compromise

Sudden BEAM VM memory growth followed by Out of memory or system_limit crashes in Elixir application logs.
Repeated OS-level OOM killer events terminating the beam.smp process on hosts running ash-based services.
Elevated request latency or 5xx responses on API endpoints that accept filter expressions traversing multiple relationships.

Detection Strategies

Inventory application dependencies for ash versions between 1.29.0-rc0 and 3.32.1 using mix deps or the compiled Mix.lock file.
Audit application code for user-controllable filters that reference multiple to-many relationship paths.
Correlate HTTP access logs with BEAM memory telemetry to identify request patterns that precede memory spikes.

Monitoring Recommendations

Emit :erlang.memory/0 metrics and total heap size per scheduler to your observability backend and alert on rapid growth.
Track process count and largest process heap size with :recon.proc_count(:memory, 10) to spot runaway filter evaluations.
Log the relationship paths present in inbound filter payloads to build a baseline of legitimate query shapes.

How to Mitigate CVE-2026-82742

Immediate Actions Required

Upgrade ash to version 3.32.2 or later in mix.exs and redeploy affected services.
Restrict filter construction on public endpoints to a whitelist of allowed fields and relationships until the upgrade is complete.
Add request-level timeouts and memory ceilings to worker processes handling filter evaluation.

Patch Information

The fix is committed to the ash-project/ash repository in commit da07f00 and shipped in release 3.32.2. Details are published in GitHub Security Advisory GHSA-mgwj-c69v-6f83, the CNA Security Advisory, and the OSV Vulnerability Report.

Workarounds

Constrain filters at the API layer so that untrusted callers cannot combine multiple to-many relationship paths in a single expression.
Cap the size of collections returned by related resources through pagination or authorization filters.
Deploy per-request memory guards using supervised worker processes so that a single malicious query cannot exhaust the entire node.

bash

# Update dependency in mix.exs and fetch the fixed release
# {:ash, "~> 3.32.2"}
mix deps.update ash
mix deps.get
mix compile