ash is vulnerable to Uncontrolled Resource Consumption
21
Low Risk
The async read limiter polls pending tasks with a zero timeout and recurses when none have completed. When every task is still pending this becomes a spin loop that consumes a scheduler thread without yielding. Slow async reads on normal request paths can exhaust scheduler resources and degrade availability. The fix waits until at least one task completes instead of busy spinning.
You are affected if you are using a version that falls within the vulnerable range and you run concurrent async reads that can remain pending under load.
ash is vulnerable to Uncontrolled Resource Consumption in versions 2.19.0 - 3.32.1.
Upgrade the ash library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.