CVE-2026-69659 ash-project CVE debrief

Who should care

Developers and administrators using ash-project ash versions between 1.17.0 and 3.31.1 should be aware of this vulnerability and take defensive actions to prevent potential memory exhaustion attacks. This includes reviewing system configurations, updating affected versions, and monitoring for suspicious activity that could indicate exploitation attempts. Security teams should prioritize patching and verifying compensating controls for exposed systems while remediation is scheduled and verified. Operators managing affected systems need to assess their exposure and implement recommended mitigations promptly. Vulnerability management processes should include tracking exceptions, retesting remediated assets, and closing items only after evidence is documented. Platform security teams should also review the impact on their environments and coordinate with developers for necessary updates or patches. Overall, a coordinated approach across development, operations, and security teams is essential to address this vulnerability effectively and minimize potential risks. Affected operators should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets that need extra review should be checked. Exceptions should be tracked, remediated assets should be retested, and the item should be closed only after evidence is documented. The executive overview should cover the affected product or component, vulnerability class, likely operational impact, source-confidence limits, and review context. The technical summary should include affected product context, defensive impact, and source-grounded technical framing without unsupported root-cause or exploit claims. The debrief should provide an overview of the vulnerability, its potential impact, and recommended actions for affected users. The technical summary should be expanded with affected product or

Technical summary

The ash-project ash library has an Uncontrolled Resource Consumption vulnerability. Attackers can craft keyset pagination cursors that, when deserialized, can allocate large amounts of memory, potentially leading to node termination. This issue affects ash versions from 1.17.0 before 3.31.1. The vulnerability is caused by the deserialization of client-supplied page[:after] or page[:before] cursors in decode_values/2 in lib/ash/page/keyset.ex, which base64-decodes the value and passes it to :erlang.binary_to_term/2 without bounding its size. The Erlang external term format supports zlib-compressed payloads, which the decoder inflates transparently, so a cursor of a few kilobytes can allocate tens of megabytes of heap in a single call. Ash itself only ever encodes cursors uncompressed, so the decoder accepts a term shape its encoder never produces. Concurrent requests aggregate these allocations and can terminate the node.

Defensive priority

Medium-priority defensive actions are recommended due to the potential for memory exhaustion via crafted keyset pagination cursors.

Recommended defensive actions

• Implement input validation and sanitization for keyset pagination cursors
• Enforce bounds checking on cursor size
• Monitor node memory usage and adjust configurations as needed
• Consider compensating controls such as rate limiting or IP blocking
• Inventory and update affected ash-project ash versions

Evidence notes

Evidence is limited; primary official records indicate an Uncontrolled Resource Consumption vulnerability in ash-project ash, allowing attackers to exhaust node memory via crafted keyset pagination cursors. Defensive verification tasks are necessary. The vulnerability affects ash versions from 1.17.0 before 3.31.1. Evidence limits suggest focusing on CVE and NVD details for now.

Official resources