Summary
CVE-2026-81636 is a high-severity denial-of-service vulnerability in ash_graphql, the GraphQL extension for the Elixir Ash Framework. The flaw allows unauthenticated clients to bypass Absinthe’s max_complexity query-cost protections by using Relay-style (first/last) or keyset pagination arguments instead of offset-based (limit) pagination, enabling attackers to force massive, resource-exhausting database reads with queries that appear trivially cheap to the complexity analyzer. The issue carries a CVSS v4.0 base score of 8.7 (High).
Technical details
- Root cause: The
query_complexity/3function inAshGraphql.Graphql.Resolver(lib/graphql/resolver.ex) only multiplies child query complexity by the requested page size when the argument map contains a:limitkey (used for offset pagination). Relay connection arguments (first,last) and keyset pagination fall through to a catch-all clause that returns onlychild_complexity + 1, regardless of the actual page size requested. - Trigger conditions: An attacker sends a nested GraphQL query using Relay pagination on multiple levels, e.g.
posts(first: 500) { edges { node { comments(first: 500) { ... } } } }. Such a query is scored as trivially inexpensive by the complexity analyzer but actually causes the resolver to materialize on the order of hundreds of thousands of rows (e.g., ~250,000 in the disclosed example), far exceeding whatmax_complexitylimits were intended to prevent. - Attack vector: Network-based, requires no authentication and no user interaction (per CVSS metrics AV:N/AC:L/AT:N/PR:N/UI:N).
- Impact: Resource exhaustion / denial of service through unbounded, amplified database reads driven entirely by attacker-controlled pagination parameters. No confidentiality or integrity impact was reported; availability impact is high (VA:H).
Affected software
- ash_graphql (Elixir/Ash Framework GraphQL extension) versions 0.16.23 up to, but not including, 1.11.0
Severity
- CVSS v4.0 Base Score: 8.7 (High)
- CVSS v4.0 Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CWE-770: Allocation of Resources Without Limits or Throttling
Mitigation and recommended actions
- Immediate: Upgrade
ash_graphqlto version 1.11.0 or later, which adds explicit complexity-calculation clauses for%{first: n}and%{last: n}arguments and properly clamps pagination arguments against the configuredmax_page_size. - If immediate patching is not possible:
- Review and reduce the configured
max_page_sizefor GraphQL resources that expose Relay or keyset pagination to limit the effective blast radius of any single query. - Monitor GraphQL endpoints for unusually deep, nested queries using
first/lastarguments combined with high page-size values, and consider rate-limiting or blocking such patterns at the API gateway/WAF layer until the upgrade is applied. - Audit application logs and database load metrics for signs of abnormal query cost that would indicate attempted exploitation prior to patching.
- Review and reduce the configured

