CVE-2026-77831 | CVSS: N/A
Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use.
With full-diff change tracking, AshPaperTrail.ChangeBuilders.FullDiff.ListChange pairs each prior array element against the new list by rebuilding the remaining-elements accumulator with acc ++ [tuple] on every step, copying the growing list each time, so the pairing scales cubically in the array length. Nothing bounds the length and the value comes stra
参考链接:
• https://cna.erlef.org/cves/CVE-2026-77831.html
• https://github.com/ash-project/ash_paper_trail/commit/e781f5d8840b07d57db99f9a47
• https://github.com/ash-project/ash_paper_trail/security/advisories/GHSA-7c66-59m
📌 数据来源: NVD 官方