Vulnerability-Lookup

FKIE_CVE-2026-77831

Vulnerability from fkie_nvd - Published: 2026-08-30 01:20 - Updated: 2026-08-30 01:20

Severity

2.1 (Low) - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Summary

Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use. With full-diff change tracking, AshPaperTrail.ChangeBuilders.FullDiff.ListChange pairs each prior array element against the new list by rebuilding the remaining-elements accumulator with acc ++ [tuple] on every step, copying the growing list each time, so the pairing scales cubically in the array length. Nothing bounds the length and the value comes straight from action input, so one request carrying a large accepted {:array, _} attribute forces tens of seconds of CPU and multi-gigabyte allocations. This issue affects ash_paper_trail: from 0.1.1 before 0.7.0.

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-77831.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ash-project/ash_paper_trail/commit/e781f5d8840b07d57db99f9a4728298837d7b3a8
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ash-project/ash_paper_trail/security/advisories/GHSA-7c66-59m8-723c
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-77831

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_paper_trail:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshPaperTrail.ChangeBuilders.FullDiff.ListChange\u0027"
          ],
          "packageName": "ash_paper_trail",
          "packageURL": "pkg:hex/ash_paper_trail",
          "product": "ash_paper_trail",
          "programFiles": [
            "lib/change_builders/full_diff/list_change.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshPaperTrail.ChangeBuilders.FullDiff.ListChange\u0027:build/2"
            }
          ],
          "repo": "https://github.com/ash-project/ash_paper_trail",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "0.7.0",
              "status": "affected",
              "version": "0.1.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_paper_trail:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshPaperTrail.ChangeBuilders.FullDiff.ListChange\u0027"
          ],
          "packageName": "ash-project/ash_paper_trail",
          "packageURL": "pkg:github/ash-project/ash_paper_trail",
          "product": "ash_paper_trail",
          "programFiles": [
            "lib/change_builders/full_diff/list_change.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshPaperTrail.ChangeBuilders.FullDiff.ListChange\u0027:build/2"
            }
          ],
          "repo": "https://github.com/ash-project/ash_paper_trail",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "e781f5d8840b07d57db99f9a4728298837d7b3a8",
              "status": "affected",
              "version": "449cd2a93416853066378fa61c715e89f80dc854",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use.\n\nWith full-diff change tracking, AshPaperTrail.ChangeBuilders.FullDiff.ListChange pairs each prior array element against the new list by rebuilding the remaining-elements accumulator with acc ++ [tuple] on every step, copying the growing list each time, so the pairing scales cubically in the array length. Nothing bounds the length and the value comes straight from action input, so one request carrying a large accepted {:array, _} attribute forces tens of seconds of CPU and multi-gigabyte allocations.\n\nThis issue affects ash_paper_trail: from 0.1.1 before 0.7.0."
    }
  ],
  "id": "CVE-2026-77831",
  "lastModified": "2026-08-30T01:20:29.597",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.1,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-30T01:20:29.597",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-77831.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ash-project/ash_paper_trail/commit/e781f5d8840b07d57db99f9a4728298837d7b3a8"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ash-project/ash_paper_trail/security/advisories/GHSA-7c66-59m8-723c"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-77831"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-407"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

CVE-2026-77831 (GCVE-0-2026-77831)

Vulnerability from cvelistv5 – Published: 2026-08-30 00:18 – Updated: 2026-08-30 00:18

Title

Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking

Summary

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

EEF mitre root

References

4 references

URL	Tags
https://github.com/ash-project/ash_paper_trail/se…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-77831.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-77831	related
https://github.com/ash-project/ash_paper_trail/co…	patch

Impacted products

2 products

Vendor	Product	Version
ash-project	ash_paper_trail	Affected: 0.1.1 , < 0.7.0 (semver) cpe:2.3:a:ash-project:ash_paper_trail::::::::
ash-project	ash_paper_trail	Affected: 449cd2a93416853066378fa61c715e89f80dc854 , < e781f5d8840b07d57db99f9a4728298837d7b3a8 (git) cpe:2.3:a:ash-project:ash_paper_trail::::::::

Credits

Peter Ullrich Peter Ullrich Zach Daniel / Ash Project Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_paper_trail:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshPaperTrail.ChangeBuilders.FullDiff.ListChange\u0027"
          ],
          "packageName": "ash_paper_trail",
          "packageURL": "pkg:hex/ash_paper_trail",
          "product": "ash_paper_trail",
          "programFiles": [
            "lib/change_builders/full_diff/list_change.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshPaperTrail.ChangeBuilders.FullDiff.ListChange\u0027:build/2"
            }
          ],
          "repo": "https://github.com/ash-project/ash_paper_trail",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "0.7.0",
              "status": "affected",
              "version": "0.1.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_paper_trail:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshPaperTrail.ChangeBuilders.FullDiff.ListChange\u0027"
          ],
          "packageName": "ash-project/ash_paper_trail",
          "packageURL": "pkg:github/ash-project/ash_paper_trail",
          "product": "ash_paper_trail",
          "programFiles": [
            "lib/change_builders/full_diff/list_change.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshPaperTrail.ChangeBuilders.FullDiff.ListChange\u0027:build/2"
            }
          ],
          "repo": "https://github.com/ash-project/ash_paper_trail",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "e781f5d8840b07d57db99f9a4728298837d7b3a8",
              "status": "affected",
              "version": "449cd2a93416853066378fa61c715e89f80dc854",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe resource must use full-diff change tracking (\u003ccode\u003echange_tracking_mode :full_diff\u003c/code\u003e) and accept an array attribute with no effective maximum length, reached through a create or update action exposed to the input.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The resource must use full-diff change tracking (`change_tracking_mode :full_diff`) and accept an array attribute with no effective maximum length, reached through a create or update action exposed to the input."
            }
          ],
          "value": "The resource must use full-diff change tracking (change_tracking_mode :full_diff) and accept an array attribute with no effective maximum length, reached through a create or update action exposed to the input."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ash-project:ash_paper_trail:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.7.0",
                  "versionStartIncluding": "0.1.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel / Ash Project"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use.\u003c/p\u003e\n\u003cp\u003eWith full-diff change tracking, \u003ccode\u003eAshPaperTrail.ChangeBuilders.FullDiff.ListChange\u003c/code\u003e pairs each prior array element against the new list by rebuilding the remaining-elements accumulator with \u003ccode\u003eacc ++ [tuple]\u003c/code\u003e on every step, copying the growing list each time, so the pairing scales cubically in the array length. Nothing bounds the length and the value comes straight from action input, so one request carrying a large accepted \u003ccode\u003e{:array, _}\u003c/code\u003e attribute forces tens of seconds of CPU and multi-gigabyte allocations.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_paper_trail: from 0.1.1 before 0.7.0.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use.\n\nWith full-diff change tracking, `AshPaperTrail.ChangeBuilders.FullDiff.ListChange` pairs each prior array element against the new list by rebuilding the remaining-elements accumulator with `acc ++ [tuple]` on every step, copying the growing list each time, so the pairing scales cubically in the array length. Nothing bounds the length and the value comes straight from action input, so one request carrying a large accepted `{:array, _}` attribute forces tens of seconds of CPU and multi-gigabyte allocations.\n\nThis issue affects ash_paper_trail: from 0.1.1 before 0.7.0."
            }
          ],
          "value": "Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use.\n\nWith full-diff change tracking, AshPaperTrail.ChangeBuilders.FullDiff.ListChange pairs each prior array element against the new list by rebuilding the remaining-elements accumulator with acc ++ [tuple] on every step, copying the growing list each time, so the pairing scales cubically in the array length. Nothing bounds the length and the value comes straight from action input, so one request carrying a large accepted {:array, _} attribute forces tens of seconds of CPU and multi-gigabyte allocations.\n\nThis issue affects ash_paper_trail: from 0.1.1 before 0.7.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407 Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-30T00:18:38.078Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ash-project/ash_paper_trail/security/advisories/GHSA-7c66-59m8-723c"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-77831.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-77831"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ash-project/ash_paper_trail/commit/e781f5d8840b07d57db99f9a4728298837d7b3a8"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-77831",
    "datePublished": "2026-08-30T00:18:38.078Z",
    "dateReserved": "2026-08-27T16:30:01.792Z",
    "dateUpdated": "2026-08-30T00:18:38.078Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

FKIE_CVE-2026-77831

CVE-2026-77831 (GCVE-0-2026-77831)

Tags

Sightings

Nomenclature