CVE-2026-82742

Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory

Published Sep 1, 2026 CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Description

Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory.

Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its related rows. flatten_relationships/2 (lib/ash/filter/runtime.ex) eagerly built the full Cartesian product across the filter's to-many relationship paths, so a record with K to-many relationships of M rows each materialized on the order of M^K scenarios before any predicate was checked. A filter or dataset that reaches several sizeable to-many relationships therefore allocates memory combinatorially and can exhaust the node. The fix streams the expansion lazily and short-circuits on the first matching scenario, bounding the work.

This issue affects ash: from 1.29.0-rc0 before 3.32.2.

Analysis

Technical impact

Uncontrolled Resource Consumption vulnerability in the Ash library allows an attacker to trigger a catastrophic memory exhaustion by crafting a filter that spans multiple to‑many relationships. The runtime expands the filter into a full Cartesian product over these relationships, allocating memory on the order of M^K scenarios before evaluating the actual predicate. This excessive allocation can deplete node memory, potentially causing the node to become unresponsive or crash. The weakness is a classic out‑of‑memory condition identified by CWE‑400.

Affected Systems

The vulnerability affects the Ash project’s Ash library from release 1.29.0‑rc0 up to, but not including, version 3.32.2. Those running any earlier or same‑version release are susceptible.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at this time. The attack likely requires an attacker to submit a carefully constructed filter expression that traverses several large to‑many relationship paths If such a filter is executed within a production node, the combinatorial expansion will consume memory, potentially leading to denial of service for all users of that node.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ash-project

ash

unaffected

Version	Status	Constraints
`1.29.0-rc0`	affected	< 3.32.2

ash-project

ash

unaffected

Version	Status	Constraints
`f6f5d194bfc7802bd32e48bf2eabd2d97a0109a4`	affected	< da07f009e889819ec410fa1f0f12534bfb9e21dd

No data.

Vendor Product Versions

Ash-project

Ash

Version	Status	Scheme	Platform
`[1.29.0-rc0,3.32.2)`	affected	semver	—
`[f6f5d194bfc7802bd32e48bf2eabd2d97a0109a4,da07f009e889819ec410fa1f0f12534bfb9e21dd)`	affected	code_commit	—

Ash-project

Ash

Version	Status	Scheme	Platform
`[f6f5d194bfc7802bd32e48bf2eabd2d97a0109a4,da07f009e889819ec410fa1f0f12534bfb9e21dd)`	affected	code_commit	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Ash library to version 3.32.2 or later, which streams the relationship expansion lazily and stops on the first match.
If an upgrade cannot be performed immediately, review and restrict filter configurations to avoid large to‑many relationship paths and enforce strict limits on dataset size.
Implement resource limits or monitoring on the node to detect abnormal memory consumption and automatically restart or throttle the process when thresholds are exceeded.

Generated by OpenCVE AI on September 1, 2026 at 04:20 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.180% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-82742.html
https://github.com/ash-project/ash/commit/da07f009e889819ec410fa1f0f12534bfb9e21dd
https://github.com/ash-project/ash/security/advisories/GHSA-mgwj-c69v-6f83
https://osv.dev/vulnerability/EEF-CVE-2026-82742

History

Sep 1, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 1, 2026 3:45 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its related rows. flatten_relationships/2 (lib/ash/filter/runtime.ex) eagerly built the full Cartesian product across the filter's to-many relationship paths, so a record with K to-many relationships of M rows each materialized on the order of M^K scenarios before any predicate was checked. A filter or dataset that reaches several sizeable to-many relationships therefore allocates memory combinatorially and can exhaust the node. The fix streams the expansion lazily and short-circuits on the first matching scenario, bounding the work. This issue affects ash: from 1.29.0-rc0 before 3.32.2.
Title		Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory
First Time appeared		Ash-project Ash-project ash
Weaknesses		CWE-400
CPEs		cpe:2.3:a:ash-project:ash::::::::
Vendors & Products		Ash-project Ash-project ash
References		https://cna.erlef.org/cves/CVE-2026-82742.html https://github.com/ash-project/ash/commit/da07f009e889819ec410fa1f0f12534bfb9e21dd https://github.com/ash-project/ash/security/advisories/GHSA-mgwj-c69v-6f83 https://osv.dev/vulnerability/EEF-CVE-2026-82742
Metrics		cvssV4_0 `{'score': 5.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`