CVE-2026-82742

Name of the Vulnerable Software and Affected Versions ash versions 1.29.0-rc0 through 3.32.1

Description An uncontrolled resource consumption issue exists where an attacker can exhaust node memory by matching a filter that spans multiple to-many relationships in memory. The flatten relationships/2 function in lib/ash/filter/runtime.ex eagerly builds a full Cartesian product across the filter's to-many relationship paths. This causes a record with K to-many relationships of M rows each to materialize M^K scenarios before any predicate is checked, leading to combinatorial memory allocation.

Recommendations Update ash to version 3.32.2 or later.