Threat Intelligence Database

CVE-2026-77831 is an inefficient algorithmic complexity vulnerability in the ash-project's ash_paper_trail library. It allows a user who can submit a large array attribute during a paper-trailed create or update action to cause a denial of service by consuming excessive CPU and memory resources. The vulnerability arises from the way the library pairs prior array elements with new ones, resulting in cubic scaling of resource use relative to the array length. This affects versions from 0.1.1 up to but not including 0.7.0.

CVE-2026-77970 is a medium severity vulnerability in ash-project's ash_paper_trail component that causes cleartext storage of sensitive information. The vulnerability arises because sensitive attributes are only redacted at the top-level resource, while embedded, union, or list values containing sensitive data are stored in cleartext in the version table. This affects versions from 0.3.0 up to but not including 0.7.0. No official patch or remediation guidance is currently available.

CVE-2026-75847 is a medium severity vulnerability in ash-project's ash_paper_trail component that causes sensitive attribute values to be stored in cleartext within the generated version resource. This occurs because the changes map storing these values is marked as not sensitive, leading to exposure in default read actions, logs, and error messages. The issue affects versions from 0.1.1 up to but not including 0.7.0.