ash_graphql vulnerabilities

2 known vulnerabilities in ash_graphql from Ash-project. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  ash_graphql: Allocation of Resources Without Limits or Throttling

  CVE-2026-81636Aug 30, 2026Ash-project

  Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.query_compl

• 7.1 High severity

  ash_graphql: Incorrect Authorization

  CVE-2026-80223Aug 30, 2026Ash-project

  Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscriptions. The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notificat