CVE-2026-69659

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-69659", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-08-06T11:00:01.574Z", "datePublished": "2026-08-09T18:01:32.896Z", "dateUpdated": "2026-08-10T17:24:04.995Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Ash.Page.Keyset'"], "packageName": "ash", "packageURL": "pkg:hex/ash", "product": "ash", "programFiles": ["lib/ash/page/keyset.ex"], "programRoutines": [{"name": "'Elixir.Ash.Page.Keyset':decode_values/2"}], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "versions": [{"lessThan": "3.31.1", "status": "affected", "version": "1.17.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Ash.Page.Keyset'"], "packageName": "ash-project/ash", "packageURL": "pkg:github/ash-project/ash", "product": "ash", "programFiles": ["lib/ash/page/keyset.ex"], "programRoutines": [{"name": "'Elixir.Ash.Page.Keyset':decode_values/2"}], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "versions": [{"lessThan": "1816b103af975221210478d61db20adcea700319", "status": "affected", "version": "f8fadc67e67c955bb68b3a8d642be13e2b7e8ca9", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A read action must declare <code>keyset? true</code> in its <code>pagination</code> block, and the application must pass a client-supplied value as the <code>:after</code> or <code>:before</code> page option.</p>"}, {"base64": false, "type": "text/markdown", "value": "A read action must declare `keyset? true` in its `pagination` block, and the application must pass a client-supplied value as the `:after` or `:before` page option."}], "value": "A read action must declare keyset? true in its pagination block, and the application must pass a client-supplied value as the :after or :before page option."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.31.1", "versionStartIncluding": "1.17.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "remediation developer", "value": "Zach Daniel"}, {"lang": "en", "type": "finder", "value": "Jisung Chae"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor.</p>\n<p>Read actions with keyset pagination deserialize the client-supplied <code>page[:after]</code> or <code>page[:before]</code> cursor in <code>decode_values/2</code> in <code>lib/ash/page/keyset.ex</code>, which base64-decodes the value and passes it to <code>:erlang.binary_to_term/2</code> without bounding its size. The Erlang external term format supports zlib-compressed payloads, which the decoder inflates transparently, so a cursor of a few kilobytes can allocate tens of megabytes of heap in a single call. Ash itself only ever encodes cursors uncompressed, so the decoder accepts a term shape its encoder never produces. Concurrent requests aggregate these allocations and can terminate the node.</p>\n<p>This issue affects ash: from 1.17.0 before 3.31.1.</p>"}, {"base64": false, "type": "text/markdown", "value": "Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor.\n\nRead actions with keyset pagination deserialize the client-supplied `page[:after]` or `page[:before]` cursor in `decode_values/2` in `lib/ash/page/keyset.ex`, which base64-decodes the value and passes it to `:erlang.binary_to_term/2` without bounding its size. The Erlang external term format supports zlib-compressed payloads, which the decoder inflates transparently, so a cursor of a few kilobytes can allocate tens of megabytes of heap in a single call. Ash itself only ever encodes cursors uncompressed, so the decoder accepts a term shape its encoder never produces. Concurrent requests aggregate these allocations and can terminate the node.\n\nThis issue affects ash: from 1.17.0 before 3.31.1."}], "value": "Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor.\n\nRead actions with keyset pagination deserialize the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex, which base64-decodes the value and passes it to :erlang.binary_to_term/2 without bounding its size. The Erlang external term format supports zlib-compressed payloads, which the decoder inflates transparently, so a cursor of a few kilobytes can allocate tens of megabytes of heap in a single call. Ash itself only ever encodes cursors uncompressed, so the decoder accepts a term shape its encoder never produces. Concurrent requests aggregate these allocations and can terminate the node.\n\nThis issue affects ash: from 1.17.0 before 3.31.1."}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 5.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-08-09T18:01:32.896Z"}, "references": [{"tags": ["related", "vendor-advisory"], "url": "https://github.com/ash-project/ash/security/advisories/GHSA-j35q-v8h8-7mwq"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-69659.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-69659"}, {"tags": ["patch"], "url": "https://github.com/ash-project/ash/commit/1816b103af975221210478d61db20adcea700319"}], "source": {"discovery": "EXTERNAL"}, "title": "Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset"}, "adp": [{"references": [{"url": "https://github.com/ash-project/ash/security/advisories/GHSA-j35q-v8h8-7mwq", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T17:23:22.371179Z", "id": "CVE-2026-69659", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T17:24:04.995Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "remediation developer", "value": "Zach Daniel"}, {"lang": "en", "type": "finder", "value": "Jisung Chae"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "modules": ["'Elixir.Ash.Page.Keyset'"], "product": "ash", "versions": [{"status": "affected", "version": "1.17.0", "lessThan": "3.31.1", "versionType": "semver"}], "packageURL": "pkg:hex/ash", "packageName": "ash", "programFiles": ["lib/ash/page/keyset.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Ash.Page.Keyset':decode_values/2"}]}, {"cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "modules": ["'Elixir.Ash.Page.Keyset'"], "product": "ash", "versions": [{"status": "affected", "version": "f8fadc67e67c955bb68b3a8d642be13e2b7e8ca9", "lessThan": "1816b103af975221210478d61db20adcea700319", "versionType": "git"}], "packageURL": "pkg:github/ash-project/ash", "packageName": "ash-project/ash", "programFiles": ["lib/ash/page/keyset.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Ash.Page.Keyset':decode_values/2"}]}], "references": [{"url": "https://github.com/ash-project/ash/security/advisories/GHSA-j35q-v8h8-7mwq", "tags": ["related", "vendor-advisory"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-69659.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-69659", "tags": ["related"]}, {"url": "https://github.com/ash-project/ash/commit/1816b103af975221210478d61db20adcea700319", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor.\n\nRead actions with keyset pagination deserialize the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex, which base64-decodes the value and passes it to :erlang.binary_to_term/2 without bounding its size. The Erlang external term format supports zlib-compressed payloads, which the decoder inflates transparently, so a cursor of a few kilobytes can allocate tens of megabytes of heap in a single call. Ash itself only ever encodes cursors uncompressed, so the decoder accepts a term shape its encoder never produces. Concurrent requests aggregate these allocations and can terminate the node.\n\nThis issue affects ash: from 1.17.0 before 3.31.1.", "supportingMedia": [{"type": "text/html", "value": "<p>Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor.</p>\n<p>Read actions with keyset pagination deserialize the client-supplied <code>page[:after]</code> or <code>page[:before]</code> cursor in <code>decode_values/2</code> in <code>lib/ash/page/keyset.ex</code>, which base64-decodes the value and passes it to <code>:erlang.binary_to_term/2</code> without bounding its size. The Erlang external term format supports zlib-compressed payloads, which the decoder inflates transparently, so a cursor of a few kilobytes can allocate tens of megabytes of heap in a single call. Ash itself only ever encodes cursors uncompressed, so the decoder accepts a term shape its encoder never produces. Concurrent requests aggregate these allocations and can terminate the node.</p>\n<p>This issue affects ash: from 1.17.0 before 3.31.1.</p>", "base64": false}, {"type": "text/markdown", "value": "Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor.\n\nRead actions with keyset pagination deserialize the client-supplied `page[:after]` or `page[:before]` cursor in `decode_values/2` in `lib/ash/page/keyset.ex`, which base64-decodes the value and passes it to `:erlang.binary_to_term/2` without bounding its size. The Erlang external term format supports zlib-compressed payloads, which the decoder inflates transparently, so a cursor of a few kilobytes can allocate tens of megabytes of heap in a single call. Ash itself only ever encodes cursors uncompressed, so the decoder accepts a term shape its encoder never produces. Concurrent requests aggregate these allocations and can terminate the node.\n\nThis issue affects ash: from 1.17.0 before 3.31.1.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "configurations": [{"lang": "en", "value": "A read action must declare keyset? true in its pagination block, and the application must pass a client-supplied value as the :after or :before page option.", "supportingMedia": [{"type": "text/html", "value": "<p>A read action must declare <code>keyset? true</code> in its <code>pagination</code> block, and the application must pass a client-supplied value as the <code>:after</code> or <code>:before</code> page option.</p>", "base64": false}, {"type": "text/markdown", "value": "A read action must declare `keyset? true` in its `pagination` block, and the application must pass a client-supplied value as the `:after` or `:before` page option.", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.31.1", "versionStartIncluding": "1.17.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-08-09T18:01:32.896Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-69659", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T17:23:22.371179Z"}}}], "references": [{"url": "https://github.com/ash-project/ash/security/advisories/GHSA-j35q-v8h8-7mwq", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-08-10T17:23:43.963Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-69659", "state": "PUBLISHED", "dateUpdated": "2026-08-09T18:01:32.896Z", "dateReserved": "2026-08-06T11:00:01.574Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-08-09T18:01:32.896Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Ash.Page.Keyset'"], "packageName": "ash", "packageURL": "pkg:hex/ash", "product": "ash", "programFiles": ["lib/ash/page/keyset.ex"], "programRoutines": [{"name": "'Elixir.Ash.Page.Keyset':decode_values/2"}], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "versions": [{"lessThan": "3.31.1", "status": "affected", "version": "1.17.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Ash.Page.Keyset'"], "packageName": "ash-project/ash", "packageURL": "pkg:github/ash-project/ash", "product": "ash", "programFiles": ["lib/ash/page/keyset.ex"], "programRoutines": [{"name": "'Elixir.Ash.Page.Keyset':decode_values/2"}], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "versions": [{"lessThan": "1816b103af975221210478d61db20adcea700319", "status": "affected", "version": "f8fadc67e67c955bb68b3a8d642be13e2b7e8ca9", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ash-hq:ash_framework:*:*:*:*:*:*:*:*", "matchCriteriaId": "E6BD669B-1C5C-410A-89F3-4921277EBEEB", "versionEndExcluding": "3.31.1", "versionStartIncluding": "1.17.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor.\n\nRead actions with keyset pagination deserialize the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex, which base64-decodes the value and passes it to :erlang.binary_to_term/2 without bounding its size. The Erlang external term format supports zlib-compressed payloads, which the decoder inflates transparently, so a cursor of a few kilobytes can allocate tens of megabytes of heap in a single call. Ash itself only ever encodes cursors uncompressed, so the decoder accepts a term shape its encoder never produces. Concurrent requests aggregate these allocations and can terminate the node.\n\nThis issue affects ash: from 1.17.0 before 3.31.1."}, {"lang": "es", "value": "Una vulnerabilidad de consumo de recursos no controlado en ash-project ash permite a un atacante agotar la memoria del nodo a trav\u00e9s de un cursor de paginaci\u00f3n de conjunto de claves manipulado.\n\nLas acciones de lectura con paginaci\u00f3n de conjunto de claves deserializan el cursor page[:after] o page[:before] proporcionado por el cliente en decode_values/2 en lib/ash/page/keyset.ex, que decodifica el valor en base64 y lo pasa a :erlang.binary_to_term/2 sin limitar su tama\u00f1o. El formato de t\u00e9rmino externo de Erlang soporta cargas \u00fatiles comprimidas con zlib, que el decodificador infla de forma transparente, por lo que un cursor de unos pocos kilobytes puede asignar decenas de megabytes de memoria heap en una sola llamada. Ash mismo solo codifica cursores sin comprimir, por lo que el decodificador acepta una forma de t\u00e9rmino que su codificador nunca produce. Las solicitudes concurrentes agregan estas asignaciones y pueden terminar el nodo.\n\nEste problema afecta a ash: desde 1.17.0 antes de 3.31.1."}], "id": "CVE-2026-69659", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-69659", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-10T17:23:22.371179Z", "version": "2.0.3"}}]}, "published": "2026-08-09T18:16:43.627", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-69659.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/ash-project/ash/commit/1816b103af975221210478d61db20adcea700319"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Vendor Advisory", "Patch"], "url": "https://github.com/ash-project/ash/security/advisories/GHSA-j35q-v8h8-7mwq"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory", "Patch"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-69659"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Vendor Advisory", "Patch"], "url": "https://github.com/ash-project/ash/security/advisories/GHSA-j35q-v8h8-7mwq"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.17.0,3.31.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f8fadc67e67c955bb68b3a8d642be13e2b7e8ca9,1816b103af975221210478d61db20adcea700319)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "ash", "vendor": "ash-project"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.17.0,3.31.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ash", "source": "cna", "vendor": "ash-project"}, "product": "ash", "vendor": "ash-project"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f8fadc67e67c955bb68b3a8d642be13e2b7e8ca9,1816b103af975221210478d61db20adcea700319)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ash", "source": "cna", "vendor": "ash-project"}, "product": "ash", "vendor": "ash-project"}], "created": "2026-08-09T19:30:04.750119+00:00", "updated": "2026-08-09T19:30:04.879289+00:00", "vendors": ["ash-project", "ash-project$PRODUCT$ash"]}