CVE-2026-81636

Name of the Vulnerable Software and Affected Versions ash graphql versions 0.16.23 through 1.10.9

Description An unauthenticated client can bypass the configured GraphQL query-complexity limit to force an unbounded database read. This occurs because the query complexity/3 function in AshGraphql.Graphql.Resolver only multiplies child complexity by the requested page size when the argument map contains :limit (used in offset pagination). Relay connections and keyset pagination utilize first and last arguments, which do not match that specific clause and instead trigger a catch-all that returns child complexity + 1. Consequently, a nested relay query can be perceived as low-complexity while causing a full fan-out during materialization, bypassing the max complexity cap in Absinthe.

Recommendations Update ash graphql to version 1.11.0 or later.