The vulnerability in ash-project ash (CVE-2026-69659) is caused by unsafe deserialization of client-supplied keyset pagination cursors in the decode_values/2 function within lib/ash/page/keyset.ex. The cursor is base64-decoded and passed to :erlang.binary_to_term/2 without size restrictions. Since the Erlang external term format supports zlib-compressed payloads, an attacker can craft a cursor that inflates to a large memory allocation, exhausting node memory. This flaw exists in versions from 1.17.0 before 3.31.1. Ash encodes cursors uncompressed, so the decoder accepts unexpected compressed terms, enabling this attack vector. Concurrent exploitation can aggregate memory exhaustion and terminate the node.

An attacker can cause uncontrolled memory consumption on the node by sending crafted pagination cursors, potentially leading to denial of service via node termination. There is no indication of code execution or data disclosure. The impact is limited to resource exhaustion resulting in service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted keyset pagination cursors or implement size bounding and validation on deserialized data to mitigate memory exhaustion risks.