Uncontrolled Resource Consumption vulnerability in the Ash library allows an attacker to trigger a catastrophic memory exhaustion by crafting a filter that spans multiple to‑many relationships. The runtime expands the filter into a full Cartesian product over these relationships, allocating memory on the order of M^K scenarios before evaluating the actual predicate. This excessive allocation can deplete node memory, potentially causing the node to become unresponsive or crash. The weakness is a classic out‑of‑memory condition identified by CWE‑400.

The vulnerability affects the Ash project’s Ash library from release 1.29.0‑rc0 up to, but not including, version 3.32.2. Those running any earlier or same‑version release are susceptible.

The CVSS score of 5.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at this time. The attack likely requires an attacker to submit a carefully constructed filter expression that traverses several large to‑many relationship paths If such a filter is executed within a production node, the combinatorial expansion will consume memory, potentially leading to denial of service for all users of that node.