The flaw is an uncontrolled resource consumption vulnerability that arises when Ash processes keyset pagination cursors. The cursor value is base64-decoded and then passed to :erlang.binary_to_term without any bounds checking. Because the Erlang external term format can decompress data without limits, a malicious cursor of a few kilobytes can inflate into tens of megabytes of heap in a single call, potentially exhausting the node’s memory and causing a crash.

The vulnerable product is Ash by the Ash Project. All versions from 1.17.0 up to and including 3.31.0 are affected. Any deployment that relies on these releases and exposes keyset pagination endpoints can be impacted.

The CVSS score of 5.9 indicates a moderate severity risk. An unauthenticated attacker can exploit the flaw by sending a crafted cursor via an API request, as the deserialization step occurs before authentication. The EPSS score is not available and the vulnerability is not listed in CISA KEV, meaning no widespread exploitation is currently known, but the ability to trigger a node crash can lead to denial of service for the affected application.