Description
Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use.

With full-diff change tracking, AshPaperTrail.ChangeBuilders.FullDiff.ListChange pairs each prior array element against the new list by rebuilding the remaining-elements accumulator with acc ++ [tuple] on every step, copying the growing list each time, so the pairing scales cubically in the array length. Nothing bounds the length and the value comes straight from action input, so one request carrying a large accepted {:array, _} attribute forces tens of seconds of CPU and multi-gigabyte allocations.

This issue affects ash_paper_trail: from 0.1.1 before 0.7.0.
Published: 2026-08-30
Score: 2.1 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

AshPaperTrail contains a computational complexity weakness (CWE-407) that allows an attacker to submit a large array attribute to a create or update action, causing the system to perform a cubic‑time comparison of array elements. This process consumes excessive CPU cycles and allocates multi‑gigabyte memory blocks, ultimately leading to a denial of service. The vulnerability is not a code execution bug but can render the application unresponsive for extended periods.

Affected Systems

The affected product is AshPaperTrail from ash-project. Versions prior to 0.7.0, including 0.1.1 up to but not including 0.7.0, contain the vulnerable implementation and are therefore at risk.

Risk and Exploitability

The CVSS score is 2.1, reflecting the low severity of the issue. No EPSS information is available, and the vulnerability is not listed in the CISA KEV catalog. The problem can be triggered by any user able to submit a large array through the exposed API endpoints; no special privileges are required. While the impact is limited to service interruption, the lack of input validation makes exploitation straightforward.

Generated by OpenCVE AI on August 30, 2026 at 01:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ash_paper_trail to version 0.7.0 or later when the issue is fixed
  • Enforce an input size limit or validate array lengths before processing to prevent large payloads from reaching the vulnerable logic
  • Monitor CPU and memory usage metrics to detect and respond to abnormal allocation spikes that may indicate an attempted exploitation

Generated by OpenCVE AI on August 30, 2026 at 01:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 30 Aug 2026 00:30:00 +0000

Type Values Removed Values Added
Description Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use. With full-diff change tracking, AshPaperTrail.ChangeBuilders.FullDiff.ListChange pairs each prior array element against the new list by rebuilding the remaining-elements accumulator with acc ++ [tuple] on every step, copying the growing list each time, so the pairing scales cubically in the array length. Nothing bounds the length and the value comes straight from action input, so one request carrying a large accepted {:array, _} attribute forces tens of seconds of CPU and multi-gigabyte allocations. This issue affects ash_paper_trail: from 0.1.1 before 0.7.0.
Title Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking
First Time appeared Ash-project
Ash-project ash Paper Trail
Weaknesses CWE-407
CPEs cpe:2.3:a:ash-project:ash_paper_trail:*:*:*:*:*:*:*:*
Vendors & Products Ash-project
Ash-project ash Paper Trail
References
Metrics cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Ash-project Ash Paper Trail
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-08-30T00:18:38.078Z

Reserved: 2026-08-27T16:30:01.792Z

Link: CVE-2026-77831

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-30T01:20:29.597

Modified: 2026-08-30T01:20:29.597

Link: CVE-2026-77831

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-30T01:30:17Z

Weaknesses
  • CWE-407

    Inefficient Algorithmic Complexity