CVE-2026-82742: Ash Package Memory Exhaustion via Combinatorial Cross-Product in Filters
Summary
CVE-2026-82742: Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Affects ash across 2 version ranges.
>= 1.29.0-rc0, < 3.32.2
>= f6f5d194bfc7802bd32e48bf2eabd2d97a0109a4, < da07f009e889819ec410fa1f0f12534bfb9e21dd
Fixed in 3.32.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ash package is an open-source framework designed for building APIs and data-driven applications in Elixir. It provides a rich set of features for managing data relationships, filters, and queries. However, it is susceptible to a resource consumption vulnerability that can lead to memory exhaustion when handling complex filters involving multiple to-many relationships.
Vulnerability Detail
The vulnerability arises from the Ash.Filter.Runtime component, which matches filters against in-memory records. It does so by expanding records into combinations of related rows, leading to a combinatorial explosion of memory usage. Specifically, for a record with K to-many relationships, each containing M rows, the memory allocation can grow exponentially to M^K scenarios before any predicate is evaluated. This uncontrolled resource consumption can exhaust the node's memory, potentially causing application crashes or degraded performance.
How To Fix
Latest published version: 3.37.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.32.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider simplifying the filters used in your application to avoid deep nesting of to-many relationships. This can help mitigate the risk of memory exhaustion until the package is updated.
Conclusion
CVE-2026-82742 represents a significant risk for applications using the Ash package, particularly those with complex data relationships. It is crucial to update to the patched version to mitigate this vulnerability and ensure the stability of your application.
See every vulnerability recorded for ash →
FAQ
CVE-2026-82742 is a vulnerability in the Ash package that allows for uncontrolled resource consumption, potentially leading to memory exhaustion.
If your application uses the Ash package with complex filters involving multiple to-many relationships, it may experience memory exhaustion, causing crashes or performance issues.
The vulnerability affects Ash versions from 1.29.0-rc0 up to, but not including, 3.32.2.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 5.9, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for ash.
