CVE-2026-81636 - Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service
Brief
CVE ID : CVE-2026-81636
Published : Aug. 30, 2026, 6:25 p. m.
- 50 minutes ago
Description : Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read.
AshGraphql. Graphql. Resolver. query_complexity/3 multiplies child complexity by the requested page size only when the argument map contains :limit (offset pagination). Relay connections and keyset pagination use first and last, which never match that clause and fall through to the catch-all that returns child_complexity + 1. A nested relay query such as posts(first: 500) { edges { node { comments(first: 500) { ...