CVE-2026-77831: Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking
Inefficient Algorithmic Complexity vulnerability in ash-project ashpapertrail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use.
With full-diff change tracking, AshPaperTrail.ChangeBuilders.FullDiff.ListChange pairs each prior array element against the new list by rebuilding the remaining-elements accumulator with acc ++ [tuple] on every step, copying the growing list each time, so the pairing scales cubically in the array length. Nothing bounds the length and the value comes straight from action input, so one request carrying a large accepted {:array, } attribute forces tens of seconds of CPU and multi-gigabyte allocations.
This issue affects ashpapertrail: from 0.1.1 before 0.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash-project ash_paper_trailto a version that resolves this vulnerability.Fixed in 0.7.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Deployments using ash_paper_trail versions from 0.1.1 before 0.7.0 are affected when a paper-trailed create or update action accepts an array attribute and uses full-diff change tracking.
What access does an attacker need to trigger the issue?
An attacker needs the ability to submit a large array attribute to an affected paper-trailed create or update action. The oversized value is accepted directly from action input, and the array length is not bounded.
Is the default configuration affected?
The issue specifically requires full-diff change tracking. The available information does not establish whether full-diff tracking is enabled by default.
What is the impact of a successful request?
A single request with a sufficiently large accepted array can cause tens of seconds of CPU consumption and multi-gigabyte memory allocations, resulting in denial of service.