ash_graphql is vulnerable to Denial of Service
69
Medium Risk
The AshGraphql.Graphql.Resolver.query_complexity/3 function computes complexity by multiplying a pagination limit argument during Absinthe complexity analysis. When a client sends an explicit limit: null, the code multiplies nil and raises an ArithmeticError. Because complexity analysis runs before execution and outside the resolver's error handling, the exception escapes and the paginated query returns a 500 response instead of a GraphQL error. The fix handles null limit arguments so complexity analysis no longer crashes.
You are affected if you are using a version that falls within the vulnerable range and you expose paginated GraphQL queries.
ash_graphql is vulnerable to Denial of Service in versions 0.16.23 - 1.10.1.
Upgrade the ash_graphql library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.