CVE-2026-82743: CWE-400 Uncontrolled Resource Consumption in ash-project ash

The vulnerability in ash-project ash arises from the function Ash.Actions.Read.AsyncLimiter.await_at_least_one/1, which waits for concurrent asynchronous read tasks by polling each with Task.yield(task, 0) in a tight loop. This polling immediately returns if tasks are still running, causing the loop to busy-spin and consume full CPU on a BEAM scheduler thread. When multiple slow reads occur concurrently, multiple schedulers can be tied up, leading to uncontrolled resource consumption. The intended fix replaces this with Task.yield_many, which performs a non-blocking sweep followed by a blocking wait with an infinite timeout, allowing the process to sleep until a task completes instead of spinning. The affected versions are ash from 2.19.0 up to but not including 3.32.2.

The vulnerability causes high CPU usage on BEAM scheduler threads due to busy-wait spinning while waiting for slow asynchronous read tasks. This can degrade performance and responsiveness of applications using affected ash versions, especially under concurrent slow read loads. However, the CVSS score of 2.1 and the low severity rating indicate that the impact is limited and does not lead to privilege escalation, data loss, or remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves updating the code to use Task.yield_many with blocking waits instead of busy polling. Until an official patch is released, users should monitor for vendor updates and consider mitigating high CPU usage by limiting concurrent slow reads or applying custom patches if feasible.