Technical impact
A busy‑spin loop in Ash.Actions.Read.AsyncLimiter causes a scheduler thread to consume all CPU cycles while awaiting slow asynchronous reads. The loop repeatedly polls each task with Task.yield(task, 0) in a tight cycle, holding the BEAM scheduler at full load for the entire duration of the slow read operation. This uncontrolled consumption of CPU resources can prevent the system from processing other requests, effectively denying service to legitimate users. The issue is identified as a Resource Exhaustion weakness (CWE‑400).
Affected Systems
The flaw affects all versions of the Ash framework from 2.19.0 up to, but not including, 3.32.2. Users operating within this version range are vulnerable if they invoke async reads that may complete slowly or involve large data loads.
Risk and Exploitability
The CVSS score of 2.1 indicates low overall severity, and the Exploit Prediction Scoring System shows no exploitation probability data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would require an attacker to trigger the slow asynchronous read path within the application, which is typically controlled by application logic. Because the failure mode only impacts CPU usage and does not expose data or allow code execution, the risk is limited to performance degradation and potential service disruption rather than confidentiality or integrity compromise.
