CVE-2026-82742: CWE-400 Uncontrolled Resource Consumption in ash-project ash

The vulnerability in ash-project ash (CVE-2026-82742) is caused by the Ash.Filter.Runtime module's flatten_relationships/2 function, which eagerly constructs the full Cartesian product of to-many relationship paths when matching filters against in-memory records. For a record with K to-many relationships each having M rows, this results in approximately M^K combinations being materialized before any predicate evaluation, leading to uncontrolled memory consumption. An attacker can exploit this by crafting filters that span multiple sizeable to-many relationships, causing the node to exhaust its memory resources. The fix involves streaming the expansion lazily and short-circuiting upon the first matching scenario to limit resource usage. The vulnerability affects ash versions from 1.29.0-rc0 before 3.32.2. No patch or official remediation level has been confirmed.

An attacker can cause the ash node to exhaust its memory by submitting filters that trigger the eager expansion of multiple to-many relationships, leading to uncontrolled resource consumption. This can degrade service availability or cause denial of service due to memory exhaustion. There is no indication of privilege escalation, data disclosure, or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using filters that span multiple to-many relationships on large datasets to reduce the risk of memory exhaustion. Monitor application behavior for signs of excessive memory use when applying complex filters.