Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-81636: AshGraphQL pagination can overload servers
CVE-2026-81636 · published 4 days ago
Summary
When a client asks for a very large page of data using the "first" or "last" options, the system fails to limit how much it reads from the database. This can cause the server to become slow or stop responding, even though the request comes from an unauthenticated user. Updating to the latest version of the AshGraphQL library applies proper limits and prevents this overload.
What to do
- Update ash_graphql to version 1.11.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | ash-project | ash_graphql |
< 1.11.0 < c3229f6a65cbabb32fd7ffcac881922d1b3b30ad |
| Hex | – | ash_graphql |
>= 0.16.23, < 1.11.0 Fix: upgrade to 1.11.0
|
Original advisory text
Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read.
AshGraphql.Graphql.Resolver.query_complexity/3 multiplies child complexity by the requested page size only when the argument map contains :limit (offset pagination). Relay connections and keyset pagination use first and last, which never match that clause and fall through to the catch-all that returns child_complexity + 1. A nested relay query such as posts(first: 500) { edges { node { comments(first: 500) { ... } } } } therefore scores as trivially cheap while materializing the full fan-out, passing an Absinthe max_complexity cap that rejects the equivalent limit-based query. The fix adds first and last clauses clamped to the action's page size.
This issue affects ash_graphql: from 0.16.23 before 1.11.0.
AshGraphql.Graphql.Resolver.query_complexity/3 multiplies child complexity by the requested page size only when the argument map contains :limit (offset pagination). Relay connections and keyset pagination use first and last, which never match that clause and fall through to the catch-all that returns child_complexity + 1. A nested relay query such as posts(first: 500) { edges { node { comments(first: 500) { ... } } } } therefore scores as trivially cheap while materializing the full fan-out, passing an Absinthe max_complexity cap that rejects the equivalent limit-based query. The fix adds first and last clauses clamped to the action's page size.
This issue affects ash_graphql: from 0.16.23 before 1.11.0.
References
- https://github.com/ash-project/ash_graphql/security/advisories/GHSA-mwc4-r9fc-h6... vendor-advisory related
- https://cna.erlef.org/cves/CVE-2026-81636.html related
- https://osv.dev/vulnerability/EEF-CVE-2026-81636 related
- https://github.com/ash-project/ash_graphql/commit/c3229f6a65cbabb32fd7ffcac88192... patch
- https://hex.pm/packages/ash_graphql Product
- https://github.com URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81636... Vendor Advisory
- https://github.com/ash-project/ash_graphql Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-81636 Vendor Advisory
- https://repo.hex.pm URL
Severity
8.7
High
Exploitation
EPSS <1%
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published30 Aug 2026
Updated2 Sep 2026
First seen30 Aug 2026
Sources
CVE-2026-81636 · NVD
CVE-2026-81636 · MITRE
EEF-CVE-2026-81636 · OSV
GHSA-mwc4-r9fc-h6mg · GHSA
CVE-2026-81636 · OSV
Monitor software like this
Free during beta