CVE-2026-77831: CWE-407 Inefficient Algorithmic Complexity in ash-project ash_paper_trail

The vulnerability in ash_paper_trail (CVE-2026-77831) is due to inefficient algorithmic complexity in the FullDiff change tracking mechanism. Specifically, AshPaperTrail.ChangeBuilders.FullDiff.ListChange pairs each prior array element with the new list by rebuilding an accumulator list with repeated list concatenations (acc ++ [tuple]) on every step. This causes the pairing operation to scale cubically with the length of the input array. Since the array length is unbounded and directly controlled by user input, an attacker can submit a large array attribute to a create or update action that uses paper-trail tracking, causing excessive CPU usage and multi-gigabyte memory allocations, leading to a denial of service. The affected versions are ash_paper_trail from 0.1.1 before 0.7.0.

An attacker able to submit large array attributes to paper-trailed create or update actions can cause a denial of service condition by forcing the application to consume excessive CPU and memory resources. This can degrade service availability and potentially crash the application or host system. The CVSS 4.0 score is low (2.1), reflecting the local attack vector and the requirement for user interaction, with limited impact scope.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting the size of array attributes accepted by paper-trailed create or update actions or implement input validation to restrict excessively large arrays to mitigate potential denial of service.