Executive brief
Ash is a declarative resource framework for Elixir applications. A busy-wait loop in the async read limiter causes CPU to spike to 100% when processing slow related-data loads or concurrent slow reads, consuming scheduler resources and degrading application performance.
Technical details
Uncontrolled Resource Consumption (CWE-400) in Ash.Actions.Read.AsyncLimiter.await_at_least_one/1 (lib/ash/actions/read/async_limiter.ex). The vulnerable code uses a tight polling loop with Task.yield(task, 0) to wait for concurrent async read tasks, which returns immediately and repeats while tasks are still running. This causes busy-spinning and holds a BEAM scheduler thread at 100% CPU during slow related-data loads or calculations; multiple concurrent slow reads can tie up additional schedulers. The fix replaces the polling loop with Task.yield_many followed by a blocking wait with timeout: :infinity, allowing the process to sleep until task completion. Affected versions: 2.19.0 through 3.32.1; patched in 3.32.2.
Affected products
- ash-project ash 2.19.0 before 3.32.2
Timeline
- 2026-09-01: disclosed: CVE-2026-82743 published