Intel

AIKIDO-2026-34869

ash_graphql is vulnerable to Denial of Service

Denial of ServiceCVE-2026-80228 Published Yesterday

69

Medium Risk

This Affects:

ELIXIRash_graphql
0.16.23 - 1.10.1
Fixed in 1.11.0
Are you affected? Scan for Free

TL;DR

The AshGraphql.Graphql.Resolver.query_complexity/3 function computes complexity by multiplying a pagination limit argument during Absinthe complexity analysis. When a client sends an explicit limit: null, the code multiplies nil and raises an ArithmeticError. Because complexity analysis runs before execution and outside the resolver's error handling, the exception escapes and the paginated query returns a 500 response instead of a GraphQL error. The fix handles null limit arguments so complexity analysis no longer crashes.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you expose paginated GraphQL queries.

Background info

ash_graphql is vulnerable to Denial of Service in versions 0.16.23 - 1.10.1.

How to fix this

Upgrade the ash_graphql library to the patch version.

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform