CVE-2026-82743

Name of the Vulnerable Software and Affected Versions ash versions 2.19.0 through 3.32.1

Description An uncontrolled resource consumption issue exists where a slow asynchronous read can cause a scheduler thread to spin at full CPU capacity. This occurs because the function await at least one() in Ash.Actions.Read.AsyncLimiter polls concurrent async read tasks using Task.yield(task, 0) in a tight loop instead of blocking. When outstanding tasks, such as slow related-data loads or calculations, are still running, the loop repeats immediately, resulting in busy-spinning that consumes a BEAM scheduler. Multiple concurrent slow reads can tie up additional schedulers.

Recommendations Update to version 3.32.2.