CVE-2026-81636: Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-30 · updated 2026-09-01
Weakness: CWE-770

Description

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.query_complexity/3 multiplies child complexity by the requested page size only when the argument map contains :limit (offset pagination). Relay connections and keyset pagination use first and last, which never match that clause and fall through to the catch-all that returns child_complexity + 1. A nested relay query such as posts(first: 500) { edges { node { comments(first: 500) { ... } } } } therefore scores as trivially cheap while materializing the full fan-out, passing an Absinthe max_complexity cap that rejects the equivalent limit-based query. The fix adds first and last clauses clamped to the action's page size. This issue affects ash_graphql: from 0.16.23 before 1.11.0.

Affected products

ash-project ash_graphql: from 0.16.23 before 1.11.0 — fixed in 1.11.0

How to fix

Upgrade to a fixed version: ash-project ash_graphql 1.11.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-81636 or the next vulnerability affects your stack