Ash keyset pagination cursor triggers node OOM
Ash (Elixir) passes client-supplied keyset cursors to :erlang.binary_to_term/2 unbounded; a zlib-compressed Erlang term payload can exhaust node memory. CVSS 4.0: 5.9 Medium.
- Vendor
- ash-project
- Product
- Ash
- CVSS
- 5.9
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Read actions with keyset pagination in Ash accept the page[:after] and page[:before] cursor values directly from clients. The function decode_values/2 in lib/ash/page/keyset.ex base64-decodes the value and passes it to :erlang.binary_to_term/2 without bounding its size. Because Erlang’s external term format supports inline zlib-compressed payloads, a crafted cursor that decompresses to a large term can exhaust the memory of the Erlang/OTP node.
The Erlang Ecosystem Foundation CNA scored this CVSS 4.0: 5.9 Medium (Local attack vector, Attack Requirements: Present). Applications exposing keyset-paginated read actions to untrusted callers should upgrade Ash immediately.
Mitigation: Update to a patched Ash release. See the CNA advisory for affected version ranges and the fix commit. NVD entry: CVE-2026-69659.
