CVE-2026-82579— AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service
Quick assessment
Affected
ash-project ash_ai
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ash-project 中的 ash_ai 库存在一个循环中退出条件不可达（无限循环）漏洞，使得能够影响模型输出的攻击者可以导致工具循环挂起，并引发无限制的重复模型请求。 会对模型的 响应进行分类，然后通过 和 对工具调用进行过滤。这两个函数都可能导致列表变为空：如果某个调用缺少有效的名称，或者复用了历史中已有结果的 ，该调用就会被丢弃。当列表为空时，循环不会添加任何内容，并以字节完全相同的消息列表进行递归，导致对话无法推进，每次迭代都会重新发送相同的请求。在支持的 配置下，循环永远不会终止；否则，它会耗尽完整的迭
Possible ATT&CK Techniques 2 AI
T1120 · Peripheral Device Discovery T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82579
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service
Source: CVE Program / CVE List V5
Vulnerability Description
Loop with Unreachable Exit Condition (Infinite Loop) vulnerability in ash-project ash_ai allows an attacker who can influence a model's output to hang the tool loop and drive unbounded, repeated model requests.
AshAi.ToolLoop classifies a model response of :tool_calls, then filters the calls through normalize_tool_calls/2 and unprocessed_tool_calls/2. Both can empty the list: a call missing a valid name, or one reusing a tool_call_id that already has a result in history, is dropped. With an empty list the loop appended nothing and recursed with a byte-identical message list, so the conversation never advanced and the same request was re-sent every iteration. Under the supported max_iterations: :infinity this never terminated; otherwise it exhausted the full budget. Prompt-injected content can make the model re-emit a spent tool_call_id. The fix treats an empty post-filter list as terminal.
This issue affects ash_ai: from 0.6.0 before 1.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ash-project | ash_ai | 0.6.0 ~ 1.0.0 |
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*
|
|
| ash-project | ash_ai | bc2122f78fca6c11d8ec2b9ac53148ec17476460 ~ 53325fdab90afab628c6a53232ef2a9001580bd9 |
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-82579
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82579
请登录查看更多情报信息。
Other References for CVE-2026-82579 (4)
-
https://github.com/ash-project/ash_ai/security/advisories/GHSA-rcx7-x2w5-mmc2 vendor-advisory related
Same Patch Batch · ash-project · 2026-08-31 · 13 CVEs total
| CVE-2026-77956 | 10.0 CRITICAL | EEx template evaluation of prompt content in AshAi enables remote code execution |
| CVE-2026-77850 | 8.4 HIGH | Stored XSS in AshAdmin relationship typeahead via unescaped label_field content |
| CVE-2026-82673 | 8.3 HIGH | Path traversal in AshAdmin file uploads via unsanitized client filename |
| CVE-2026-82722 | 8.3 HIGH | AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node D |
| CVE-2026-75757 | 8.3 HIGH | AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a |
| CVE-2026-81315 | 7.4 HIGH | MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header |
| CVE-2026-75760 | 7.1 HIGH | AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a us |
| CVE-2026-82564 | 7.1 HIGH | Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unident |
| CVE-2026-82580 | 5.3 MEDIUM | AshAi echoes raw tool exception messages into the conversation, disclosing internal detail |
| CVE-2026-81853 | 2.3 LOW | AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attrib |
| CVE-2026-81852 | 2.1 LOW | AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass |
| CVE-2026-82681 | 2.0 LOW | Query-parameter injection in AshAdmin row-action links via unencoded string primary keys |
IV. Related Vulnerabilities
Same product: ash_ai
-
CVE-2026-75760
AshAi vectorize change leaks raw embedding-provider errors, -
CVE-2026-82580
AshAi echoes raw tool exception messages into the conversati -
CVE-2026-82564
Identity tool filter in AshAi accepts operator maps, allowin -
CVE-2026-81315
MCP DNS-rebinding origin check in AshAi is bypassed by a spo -
CVE-2026-77956
EEx template evaluation of prompt content in AshAi enables r
Same vendor: ash-project
-
CVE-2026-82673
Path traversal in AshAdmin file uploads via unsanitized clie -
CVE-2026-81853
AshAdmin composite primary key decoding accepts arbitrary fi -
CVE-2026-81852
AshAdmin ships a hardcoded CSP nonce, allowing nonce-based C -
CVE-2026-82681
Query-parameter injection in AshAdmin row-action links via u -
CVE-2026-77850
Stored XSS in AshAdmin relationship typeahead via unescaped
Same weakness: CWE-835
-
CVE-2026-82605
BareBones BBEdit Lasso Language Tokenizer infinite loop -
CVE-2025-10903
Loop with Unreachable Exit Condition ('Infinite Loop') in Gi -
CVE-2026-78250
bytebot-ai bytebot Agent Execution Workflow infinite loop -
CVE-2026-45271
picotls has infinite recursion in the minicrypto ASN.1 decod -
CVE-2026-61556
LiquidJS: An infinite loop vulnerability in `strip_html` fil
V. Comments for CVE-2026-82579
No comments yet