A serious vulnerability in Ash's Page Keyset could lead to a memory leak and termination of an Elixir application when public read operations accept specially crafted paging pointers. The issue was documented as CVE-2026-69659 and was fixed in version 3.31.1.
The vulnerability affects Ash, a declarative application development framework for the Elixir ecosystem. The issue is in the way Ash's Page Keyset decodes the page[:after] and page[:before] parameters in read operations that use keyset paging.
See also: Nuxt: DoS vulnerability affects server islands
Why Ash's Page Keyset leads to memory exhaustion
Keyset pointers are serialized values returned by Ash and reused by the client for the next or previous page. Before the fix, the framework would do Base64 decoding and pass the data to :erlang.binary_to_term/2, with no limit on the size of the result.
Erlang's external condition format supports compressed data. Thus, a few KB pointer can be decompressed to tens of MB in a single call. Many concurrent requests accumulate memory commitments and can kill the node, causing a service outage.
The official Ash security update rates the vulnerability as moderate severity. Exploitation requires a read action with keyset? true and an application passing the after or before from the request in the page.
Versions affected by CVE-2026-69659
According to the CVE filing by the Erlang Ecosystem Foundation, versions of the ash package from 1.17.0 to before 3.31.1. The CVSS 4.0 rating reflects a severe availability impact, while the NVD database has not yet completed its own detailed bulletin.
The issue does not mean that every Ash installation is automatically vulnerable. It requires a public keyset paging function and the ability for the user to check the pointer. However, applications that expose such points via API should be considered a priority, because the attack can be repeated with concurrent requests.
To control exposure, administrators can look for keyset? true in the code and confirm that the pointers returned by the service are not being converted to raw data. Logging failed pointers also helps identify automated tests.
The technical cause is related to untrusted deserialization, classified as CWE-502. Ash normally generates uncompressed pointers, but the decoder also accepted formats that the framework itself does not produce. This asymmetry opened the way for excessive resource consumption.
See also: SQL injection in Oracle with SYSTEM access
Ash's correction and recommendations
Version 3.31.1 adds checking of Ash's Page Keyset before deserialization. The default limit for the decoded index is 10 KiB, while compressed payloads are rejected out of the box. An index that exceeds the limit or is invalid returns an error Ash.Error.Page.InvalidKeyset, rather than continuing with the term conversion.
The change is in the decode_values/2 in lib/ash/page/keyset.ex and comes with tests for normal, oversized, and compressed pointers. Teams that need larger legal values can adjust max_keyset_byte_sizeafter examining the data they use in their own application.
The SecNews technical team recommends immediately upgrading the package and testing Ash's Page Keyset functionality after installing version 3.31.1 or later. Until the change is complete, administrators should review which access points enable keyset paging, restrict access where possible, and monitor for unusual memory increases.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: New techniques for detecting vulnerabilities in Apache
Ash's Page Keyset FAQ
What is the main risk? A malicious user can send a specially crafted pointer to an access point with keyset paging and cause excessive memory consumption. In a high-demand environment, the consequence can be an application termination.
What should be done first? The safest option is to upgrade to version 3.31.1 or later. At the same time, the read points that accept the after and beforeto confirm that the fix was applied to all services.
CVE-2026-69659 is not a remote code execution vulnerability, but a vulnerability in Ash's Page Keyset that can affect applications with public APIs. Early notification, request limits, and memory monitoring significantly reduce the risk, without requiring changes to the logic of legitimate pointers.
