Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to exhaust database storage and memory.

The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolveclient/3 in AshAuthentication.Oauth2Server.CIMD fetches the document for each new URL-shaped clientid and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in CIMD.Cache before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.

This issue affects ashauthenticationoauth2server: from 0.3.0 before 0.3.1.

An issue was discovered in the ash crate before 0.33.1 for Rust. util::readspv may read from uninitialized memory locations.