CVE-2026-82579: AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service

Q: Who is realistically exposed to exploitation?

Deployments are exposed when an attacker can influence the model's output, including through prompt-injected content that causes the model to re-emit a tool_call_id that already has a result in the conversation history. Calls with missing valid names can also be filtered out and trigger the condition.

Q: What configurations make the impact most severe?

The supported max_iterations: :infinity setting allows the loop to continue indefinitely, producing unbounded repeated model requests. With a finite iteration limit, the loop still consumes the entire configured iteration budget before stopping.

Q: What can be done if an upgrade is not immediately possible?

Avoid using max_iterations: :infinity and set a finite iteration limit to bound repeated requests. Monitor for tool-loop iterations that resend a byte-identical message list after all candidate tool calls have been filtered out.

Q: How can I tell whether a deployment is affected?

Versions from 0.6.0 before 1.0.0 are affected. During exploitation, the loop repeatedly sends the same model request because no accepted tool call is appended to advance the conversation.

Published Aug 31, 2026

Updated

Loop with Unreachable Exit Condition (Infinite Loop) vulnerability in ash-project ashai allows an attacker who can influence a model's output to hang the tool loop and drive unbounded, repeated model requests.

AshAi.ToolLoop classifies a model response of :toolcalls, then filters the calls through normalizetoolcalls/2 and unprocessedtoolcalls/2. Both can empty the list: a call missing a valid name, or one reusing a toolcallid that already has a result in history, is dropped. With an empty list the loop appended nothing and recursed with a byte-identical message list, so the conversation never advanced and the same request was re-sent every iteration. Under the supported maxiterations: :infinity this never terminated; otherwise it exhausted the full budget. Prompt-injected content can make the model re-emit a spent toolcallid. The fix treats an empty post-filter list as terminal.

This issue affects ashai: from 0.6.0 before 1.0.0.

Affected Software

1 affected component

ash-project/ash_ai>=0.6.0<1.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ash-project ash_ai to a version that resolves this vulnerability.
Fixed in 1.0.0
Configuration
Update AshAi.ToolLoop logic so that after normalize_tool_calls/2 and unprocessed_tool_calls/2 filtering, an empty post-filter list is treated as a terminal condition (stop recursing) instead of re-sending the same request indefinitely.
AshAi.ToolLoop terminal condition when post-filter tool calls list is empty = terminate

Event History

Aug 31, 2026

CVE Published

via MITRE·01:07 AM

Data Sourced

via MITRE·01:07 AM

DescriptionWeakness

Frequently Asked Questions

Who is realistically exposed to exploitation?

Deployments are exposed when an attacker can influence the model's output, including through prompt-injected content that causes the model to re-emit a tool_call_id that already has a result in the conversation history. Calls with missing valid names can also be filtered out and trigger the condition.

What configurations make the impact most severe?

The supported max_iterations: :infinity setting allows the loop to continue indefinitely, producing unbounded repeated model requests. With a finite iteration limit, the loop still consumes the entire configured iteration budget before stopping.

What can be done if an upgrade is not immediately possible?

Avoid using max_iterations: :infinity and set a finite iteration limit to bound repeated requests. Monitor for tool-loop iterations that resend a byte-identical message list after all candidate tool calls have been filtered out.

How can I tell whether a deployment is affected?

Versions from 0.6.0 before 1.0.0 are affected. During exploitation, the loop repeatedly sends the same model request because no accepted tool call is appended to advance the conversation.

CVE-2026-82579: AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to exploitation?

What configurations make the impact most severe?

What can be done if an upgrade is not immediately possible?

How can I tell whether a deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to exploitation?

What configurations make the impact most severe?

What can be done if an upgrade is not immediately possible?

How can I tell whether a deployment is affected?