CVE-2026-81636

ash_graphql versions 0.16.23 through before 1.11.0 miscompute GraphQL query complexity for relay-style connections and keyset pagination: the complexity calculator in AshGraphql.Graphql.Resolver.query_complexity/3 only multiplies child complexity by the requested page size when the legacy offset-pagination :limit argument is present, so queries using first/last fall through to a catch-all scored as child_complexity + 1. An unauthenticated client can therefore send nested relay queries such as posts(first: 500) { edges { node { comments(first: 500) { ... } } } } that pass an Absinthe max_complexity cap while the server actually materializes the full pagination fan-out from the database. The attacker gains the ability to force unbounded database reads and exhaust database or application resources, causing denial of service (CVSS 4.0 availability impact rated 8.7 High, no privileges or user interaction required). Any Elixir application exposing an Ash-backed GraphQL API on an affected ash_graphql version and relying on Absinthe complexity limits for protection is affected, especially where relay connections or keyset pagination are used. No public proof-of-concept, KEV listing, or known exploitation exists; EPSS estimates only a 0.3% chance of exploitation within 30 days.

What to do: Upgrade ash_graphql to 1.11.0 or later, which adds first/last complexity clauses clamped to the action's page size. As interim mitigation, set a conservative Absinthe max_complexity, configure max_page_size caps on paginated Ash actions to limit actual reads, rate-limit the GraphQL endpoint, and monitor database load for unbounded queries from unauthenticated clients.