EEF-CVE-2026-77831 CVE-2026-77831 GHSA-7c66-59m8-723c
Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking
- Severity
- 0.0 / 10
- Unknown · CVSS 4.0
- Exploit chance (EPSS)
- 0.18%
- Chance of exploitation in the next 30 days. Higher than 7.56% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-407 Inefficient Algorithmic Complexity
- Fix
0.7.0- Upgrade ash_paper_trail to this version or later
Description
Summary
Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use.
With full-diff change tracking, AshPaperTrail.ChangeBuilders.FullDiff.ListChange pairs each prior array element against the new list by rebuilding the remaining-elements accumulator with acc ++ [tuple] on every step, copying the growing list each time, so the pairing scales cubically in the array length. Nothing bounds the length and the value comes straight from action input, so one request carrying a large accepted {:array, _} attribute forces tens of seconds of CPU and multi-gigabyte allocations.
This issue affects ash_paper_trail: from 0.1.1 before 0.7.0.
Configurations
The resource must use full-diff change tracking (change_tracking_mode :full_diff) and accept an array attribute with no effective maximum length, reached through a create or update action exposed to the input.
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| ash_paper_trail | >= 0.1.1, < 0.7.0 |
0.7.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ash_paper_trail Hex → 0.7.0
- mix
{:ash_paper_trail, "~> 0.7.0"} # then: mix deps.update ash_paper_trail
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- Attack vector
- Local
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-407: Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-77970 Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions | Not rated yet | Also affects ash_paper_trail |
| EEF-CVE-2026-75847 Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail | Not rated yet | Also affects ash_paper_trail |
| GHSA-2qm8-x737-gmw5 pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding | High | Same weakness, CWE-407 |
| GHSA-mm57-4v3p-rchx pyasn1 has quadratic-complexity denial of service in binary REAL decoding | High | Same weakness, CWE-407 |
| GHSA-9m75-vc3g-4x39 pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding | High | Same weakness, CWE-407 |
| GHSA-fm9c-5rcf-2q5p pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding | High | Same weakness, CWE-407 |
| GHSA-mgcc-cww5-fp2q Go JOSE: DoS when parsing JWKs that contain RSA keys | High | Same weakness, CWE-407 |
| EEF-CVE-2026-65631 erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service | Not rated yet | Same weakness, CWE-407 |
Credits: Jonatan Männchen / EEF, Peter Ullrich, Zach Daniel / Ash Project
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor