CVE-2026-81636

ash_graphql (ash-project) versions 0.16.23 through before 1.11.0 contain an allocation-of-resources flaw that lets an unauthenticated client bypass the configured GraphQL query-complexity limit. The root cause is in AshGraphql.Graphql.Resolver.query_complexity/3, which multiplies child complexity...

EEF-CVE-2026-81636 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service

Summary Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child...