CVE-2026-81636: CWE-770 Allocation of Resources Without Limits or Throttling in ash-project ash_graphql

The vulnerability in ash_graphql involves improper handling of query complexity calculation in AshGraphql.Graphql.Resolver.query_complexity/3. While offset pagination with a :limit argument correctly multiplies child complexity by the requested page size, Relay connections using first and last parameters do not trigger this logic and instead fall through to a catch-all clause that underestimates complexity by adding only 1. This allows nested Relay queries with large first or last values to appear cheap in complexity scoring while causing unbounded database reads, bypassing the Absinthe max_complexity cap. The fix involves adding clauses for first and last parameters clamped to the action's page size, but no official patch is documented yet.

An unauthenticated attacker can bypass configured GraphQL query complexity limits, forcing the system to perform unbounded database reads. This can lead to resource exhaustion, potential denial of service, and degraded application performance. The vulnerability affects all users of ash_graphql versions from 0.16.23 up to but not including 1.11.0.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing additional query complexity validation or rate limiting at the application or infrastructure level to mitigate unbounded query execution risks.