AIKIDO-2026-713566
ash is vulnerable to Deserialization of Untrusted Data
59
Medium Risk
This Affects:
ashTL;DR
Read actions that use keyset pagination decode the client-supplied after or before cursor by base64-decoding it and converting it to an Erlang term without bounding the encoded or decoded size. Because the Erlang external term format supports compression, a small cursor can inflate into a term orders of magnitude larger in a single allocation. Sending such cursors exhausts the node's memory and can terminate it. The fix rejects compressed cursor payloads and caps the decoded cursor size before conversion.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you expose a read action with keyset pagination that passes a user-controlled after or before cursor into the page option.
Background info
ash is vulnerable to Deserialization of Untrusted Data in versions 1.17.0 - 3.31.0.
How to fix this
Upgrade the ash library to the patch version.
Links
Other
github.com/ash-project/ash/blob/v3.31.1/CHANGELOG.md#v3311-2026-08-09
cna.erlef.org/cves/CVE-2026-69659.htmlosv.dev/vulnerability/EEF-CVE-2026-69659
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant