Ash keyset pagination cursor triggers node OOM
Ash (Elixir) passes client-supplied keyset cursors to :erlang.binary_to_term/2 unbounded; a zlib-compressed Erlang term payload can exhaust node memory. CVSS 4.0: 5.9 Medium.
- Vendor
- ash-project
- Product
- Ash
- CVSS
- 5.9
- EPSS (exploit probability)
- 0.4%
- Status
- patched
- Published
Is CVE-2026-69659 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-69659 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.4% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-69659 timeline
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Read actions with keyset pagination in Ash accept the page[:after] and page[:before] cursor values directly from clients. The function decode_values/2 in lib/ash/page/keyset.ex base64-decodes the value and passes it to :erlang.binary_to_term/2 without bounding its size. Because Erlang’s external term format supports inline zlib-compressed payloads, a crafted cursor that decompresses to a large term can exhaust the memory of the Erlang/OTP node.
The Erlang Ecosystem Foundation CNA scored this CVSS 4.0: 5.9 Medium (Local attack vector, Attack Requirements: Present). Applications exposing keyset-paginated read actions to untrusted callers should upgrade Ash immediately.
Mitigation: Update to a patched Ash release. See the CNA advisory for affected version ranges and the fix commit. NVD entry: CVE-2026-69659.
Other ash-project CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-77956 AshAI Evaluates Model Output as Live Elixir Codewrite-up | [ CRITICAL ] | — | 0.3% | — |
| CVE-2026-70395 Ash managed relationship lookup bypasses authorizationwrite-up | [ LOW ] | 2.1 | 0.2% | — |
