Description
Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key.

AshAuthentication.Base.decode62/1 in lib/ash_authentication/base.ex splits its argument into one binary per character and folds it with charval62/2, which recomputes Integer.pow(62, index) at every position instead of accumulating by Horner's method, so cost grows roughly cubically in the input length. bindecode62/1 in the same module is quadratic through Integer.undigits/2 and Integer.digits/2. Neither function caps byte_size/1, and AshAuthentication.Strategy.ApiKey.SignInPreparation passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding rescue clauses catch exceptions, not CPU or memory exhaustion.

This issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Published: 2026-09-17
Score: 8.2 High
EPSS: n/a
KEV: No
Impact: Denial of Service through excessive CPU and memory usage
Action: Immediate Patch
AI Analysis

Impact

An efficiency flaw in AshAuthentication’s base62 decoder causes it to recompute powers for every character, leading to an approximate cubic cost in input length. An unauthenticated attacker can submit an oversized base62 segment in an API key, exhausting CPU cycles and memory and causing legitimate sign‑in requests to fail. The weakness is classified as CWE-407 (Excessive Computation).

Affected Systems

The vulnerability is present in team‑alembic AshAuthentication versions 4.8.0 up to but not including 4.15.0, as well as 5.0.0‑rc.0 up to but not including 5.0.0‑rc.14; any installations using these ranges are exposed.

Risk and Exploitability

The CVSS score of 8.2 indicates a high severity denial of service vulnerability. EPSS data is unavailable, but exploiting it requires only an unauthenticated HTTP request with an oversized API key; no authentication or privileged access is needed. Because the code does not guard against resource exhaustion, an attacker can repeatedly trigger the flaw. The vulnerability is not yet tracked in the CISA KEV catalog, yet the impact warrants immediate remediation.

Generated by OpenCVE AI on September 17, 2026 at 22:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade AshAuthentication to version 4.15.0 or later, or to 5.0.0‑rc.14 or later, which removes the inefficient decoding logic.
  • If an upgrade cannot be performed immediately, enforce a strict maximum length on API key segments and reject any key that exceeds this limit before decoding.
  • Apply rate limiting or throttling to the API key sign‑in endpoint to mitigate repeated DoS attempts.

Generated by OpenCVE AI on September 17, 2026 at 22:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key. AshAuthentication.Base.decode62/1 in lib/ash_authentication/base.ex splits its argument into one binary per character and folds it with charval62/2, which recomputes Integer.pow(62, index) at every position instead of accumulating by Horner's method, so cost grows roughly cubically in the input length. bindecode62/1 in the same module is quadratic through Integer.undigits/2 and Integer.digits/2. Neither function caps byte_size/1, and AshAuthentication.Strategy.ApiKey.SignInPreparation passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding rescue clauses catch exceptions, not CPU or memory exhaustion. This issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Title Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in
First Time appeared Team-alembic
Team-alembic ash Authentication
Weaknesses CWE-407
CPEs cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
Vendors & Products Team-alembic
Team-alembic ash Authentication
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Team-alembic Ash Authentication
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-09-17T18:21:26.238Z

Reserved: 2026-08-31T01:00:10.817Z

Link: CVE-2026-82760

cve-icon Vulnrichment

Updated: 2026-09-17T18:21:18.679Z

cve-icon NVD

Status : Received

Published: 2026-09-17T14:17:33.237

Modified: 2026-09-17T19:17:04.490

Link: CVE-2026-82760

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T01:45:16Z

Weaknesses
  • CWE-407

    Inefficient Algorithmic Complexity