Executive brief
ash_paper_trail is an Elixir library that tracks changes to data records. A denial-of-service vulnerability allows an attacker to submit a large array through a create or update action, causing the application to consume excessive CPU and memory and become unresponsive. This could interrupt normal business operations and impact application availability for legitimate users.
Technical details
The vulnerability is an inefficient algorithmic complexity flaw in the FullDiff.ListChange component of ash_paper_trail's change tracking system. When processing array attributes with full-diff change tracking enabled, the code rebuilds an accumulator using acc ++ [tuple] on every iteration, resulting in cubic time complexity (O(n³)) relative to array length. Since the array length is derived directly from user input with no validation, an attacker can craft a request with a large array attribute to trigger tens of seconds of CPU consumption and multi-gigabyte memory allocations. The vulnerability affects versions 0.1.1 through 0.6.x; patching is available in version 0.7.0 and later.
Affected products
- ash-project ash_paper_trail 0.1.1 to before 0.7.0
Timeline
- 2026-08-30: disclosed