Intel

AIKIDO-2026-517253

ash is vulnerable to Uncontrolled Resource Consumption

Uncontrolled Resource ConsumptionCVE-2026-82743 Published 2 days ago

21

Low Risk

This Affects:

ELIXIRash
2.19.0 - 3.32.1
Fixed in 3.32.2
Are you affected? Scan for Free

TL;DR

The async read limiter polls pending tasks with a zero timeout and recurses when none have completed. When every task is still pending this becomes a spin loop that consumes a scheduler thread without yielding. Slow async reads on normal request paths can exhaust scheduler resources and degrade availability. The fix waits until at least one task completes instead of busy spinning.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run concurrent async reads that can remain pending under load.

Background info

ash is vulnerable to Uncontrolled Resource Consumption in versions 2.19.0 - 3.32.1.

How to fix this

Upgrade the ash library to the patch version.

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform