Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read.

AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child complexity by the requested page size only when the argument map contains :limit (offset pagination). Relay connections and keyset pagination use first and last, which never match that clause and fall through to the catch-all that returns childcomplexity + 1. A nested relay query such as posts(first: 500) { edges { node { comments(first: 500) { ... } } } } therefore scores as trivially cheap while materializing the full fan-out, passing an Absinthe maxcomplexity cap that rejects the equivalent limit-based query. The fix adds first and last clauses clamped to the action's page size.

This issue affects ashgraphql: from 0.16.23 before 1.11.0.

Improper Input Validation vulnerability in ash-project ashgraphql allows an unauthenticated client to crash a relay node(id: ...) query with an unhandled KeyError.

AshGraphql.Graphql.Resolver.resolvenode/2 decodes the client-supplied global ID with decoderelayid/1, which only base64-decodes the string and splits it on : without validating the type segment. The decoded type is passed straight to Map.fetch!(typetodomainandresourcemap, type). Because fetch! raises on a missing key, a relay ID whose type segment is a valid atom that is not a relay-exposed type aborts the resolver before its resolve/2 clauses and their rescue handlers run, so the error never becomes a GraphQL error and may expose a stacktrace. Common resource names are easy to guess. The fix uses Map.fetch/2 and returns an Invalid node id error for unknown types.

This issue affects ashgraphql: from 0.27.0 before 1.11.0.