Executive brief
Ash is a declarative, resource-oriented application framework used to build data-driven applications in Elixir. A vulnerability in the filter matching engine allows attackers to exhaust a server's memory by crafting filters that traverse multiple related data collections, causing the system to compute and hold a combinatorial explosion of data in RAM simultaneously, potentially taking down the service.
Technical details
The vulnerability is an uncontrolled resource consumption flaw in Ash.Filter.Runtime's flatten_relationships/2 function (lib/ash/filter/runtime.ex). When matching a filter against an in-memory record, the function eagerly constructed the full Cartesian product of all to-many relationship combinations before evaluating any predicates—materializing on the order of M^K scenarios for K to-many relationships with M rows each. An attacker with the ability to submit filters (typically an authenticated user, but potentially unauthenticated depending on application design) can craft a filter spanning multiple large to-many relationships to force combinatorial memory allocation and exhaust the node. The fix streams the expansion lazily and short-circuits on the first match, bounding work and memory usage. This affects Ash versions 1.29.0-rc0 through 3.32.1.
Affected products
- ash-project Ash 1.29.0-rc0 to 3.32.1
Timeline
- 2026-09-01: disclosed