Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-77831— Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking

Quick assessment

Affected
ash-project ash_paper_trail
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

低效算法复杂度漏洞 存在于 ash-project 的 ，使得能够向带轨迹的创建或更新操作提交大型数组属性的用户，能够通过过度消耗 CPU 和内存资源来引发拒绝服务（DoS）攻击。 在启用“全量差异”变更跟踪时， 在处理列表变更时，会将每个先前数组元素与新的列表进行配对。该过程在每一步都通过 重建剩余元素累加器，每次都会复制不断增长的列表，因此配对操作的复杂度随数组长度的立方增长（O(n³)）。由于没有任何机制限制数组长度，且该值直接来自操作输入参数，一个携带大型受支持 属性的请求将导致数十秒的 CPU 占用和多

CVSS 2.1 · Low

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77831

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking
Source: CVE Program / CVE List V5
Vulnerability Description
Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use. With full-diff change tracking, AshPaperTrail.ChangeBuilders.FullDiff.ListChange pairs each prior array element against the new list by rebuilding the remaining-elements accumulator with acc ++ [tuple] on every step, copying the growing list each time, so the pairing scales cubically in the array length. Nothing bounds the length and the value comes straight from action input, so one request carrying a large accepted {:array, _} attribute forces tens of seconds of CPU and multi-gigabyte allocations. This issue affects ash_paper_trail: from 0.1.1 before 0.7.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ash-project ash_paper_trail 0.1.1 ~ 0.7.0 cpe:2.3:a:ash-project:ash_paper_trail:*:*:*:*:*:*:*:*
ash-project ash_paper_trail 449cd2a93416853066378fa61c715e89f80dc854 ~ e781f5d8840b07d57db99f9a4728298837d7b3a8 cpe:2.3:a:ash-project:ash_paper_trail:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-77831

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77831

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-77831 (1)

Vendor Advisories for CVE-2026-77831 (3)

Same Patch Batch · ash-project · 2026-08-30 · 4 CVEs total

CVE-2026-77970 5.9 MEDIUM Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions
CVE-2026-75847 5.9 MEDIUM Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail
CVE-2026-77846 2.1 LOW JSON path injection via unescaped get_path segments in AshSqlite

IV. Related Vulnerabilities

Same product: ash_paper_trail
Same vendor: ash-project
Same weakness: CWE-407

V. Comments for CVE-2026-77831

No comments yet

Leave a comment