CVE-2026-81636: AshGraphql Denial of Service via Query-Complexity Limit Bypass
Summary
CVE-2026-81636: Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash\_graphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read... Affects ash_graphql across 2 version ranges.
>= 0.16.23, < 1.11.0
>= d8a3e1b15587180ad9cb3ceeb398863d086c163b, < c3229f6a65cbabb32fd7ffcac881922d1b3b30ad
Fixed in 1.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshGraphql is a library designed for building GraphQL APIs in Elixir, providing a structured way to handle queries and mutations. It allows developers to define their data models and relationships, enabling efficient data retrieval and manipulation. However, it has a vulnerability that allows unauthenticated clients to bypass query-complexity limits, potentially leading to denial of service through unbounded database reads.
Vulnerability Detail
The vulnerability arises from the way AshGraphql handles pagination arguments in GraphQL queries. Specifically, the query-complexity limit is bypassed when using 'first' and 'last' pagination arguments, which do not trigger the complexity calculation for child nodes. This allows attackers to craft nested queries that appear inexpensive but can result in extensive database reads, overwhelming the system and leading to denial of service. The issue affects versions from 0.16.23 up to, but not including, 1.11.0.
How To Fix
Latest published version: 1.12.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement rate limiting on your GraphQL endpoints to mitigate the impact of potential denial of service attacks. Additionally, consider validating and restricting the size of incoming queries to prevent excessive resource consumption.
Conclusion
CVE-2026-81636 represents a significant risk for applications using AshGraphql, allowing for denial of service through unbounded database reads. It is crucial to update to the patched version 1.11.0 or later to mitigate this risk effectively. Additionally, consider implementing workarounds to protect your application until the update can be applied.
See every vulnerability recorded for ash_graphql →
FAQ
CVE-2026-81636 is a vulnerability in the AshGraphql library that allows unauthenticated clients to bypass query-complexity limits, leading to potential denial of service.
Versions of AshGraphql from 0.16.23 to just before 1.11.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
If you cannot update immediately, implement rate limiting and validate incoming queries to reduce the risk of denial of service attacks.
Related vulnerabilities
Recent vulnerabilities recorded for ash_graphql.
