CVE-2026-67579 Filter expression injection via forged keyset pagination cursor in Ash

Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the...

EEF-CVE-2026-67579 Filter expression injection via forged keyset pagination cursor in Ash

Summary Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination deco...

PT-2026-69308

Name of the Vulnerable Software and Affected Versions ash-project ash versions 1.17.0 through 3.31.0 Description An uncontrolled resource consumption issue exists where an attacker can exhaust node memory using a crafted keyset pagination cursor. Read actions utilizing keyset pagination deseriali...

CVE-2026-69659: Deserialization of Untrusted Data

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...