Vulnerability · Published Sep 1, 2026 · Assigned by EEF
CVE-2026-82742Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory
Medium 5.9
In plain English
A medium-severity uncontrolled resource consumption in ash from ash-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Official description
Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its related rows. flatten_relationships/2 (lib/ash/filter/runtime.ex) eagerly built the full Cartesian product across the filter's to-many relationship paths, so a record with K to-many relationships of M rows each materialized on the order of M^K scenarios before any predicate was checked. A filter or dataset that reaches several sizeable to-many relationships therefore allocates memory combinatorially and can exhaust the node. The fix streams the expansion lazily and short-circuits on the first matching scenario, bounding the work. This issue affects ash: from 1.29.0-rc0 before 3.32.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ash-project | ash | 1.29.0-rc0 – before 3.32.2 |
| ash-project | ash | f6f5d194bfc7802bd32e48bf2eabd2d97a0109a4 – before da07f009e889819ec410fa1f0f12534bfb9e21dd |
Weakness: CWE-400 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N