CVE-2026-69659

Name of the Vulnerable Software and Affected Versions ash-project ash versions 1.17.0 through 3.31.0

Description An uncontrolled resource consumption issue exists where an attacker can exhaust node memory using a crafted keyset pagination cursor. Read actions utilizing keyset pagination deserialize client-supplied cursors via the decode values/2 function in lib/ash/page/keyset.ex. This process base64-decodes the value and passes it to :erlang.binary to term/2 without size bounding. Because the Erlang external term format supports zlib-compressed payloads, the decoder may inflate a small cursor into tens of megabytes of heap memory. Since the software only encodes cursors as uncompressed, the decoder accepts term shapes that the encoder does not produce. Multiple concurrent requests can aggregate these allocations and cause the node to terminate. This involves the page[:after] and page[:before] variables.

Recommendations Update ash-project ash to version 3.31.1 or later.