Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-81636 – Denial of Service via GraphQL Query-Complexity Bypass – ash_graphql 0.16.23 to <1.1

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-81636 is a high-severity denial-of-service vulnerability in ash_graphql, the GraphQL extension for the Elixir Ash Framework. The flaw allows unauthenticated clients to bypass Absinthe’s max_complexity query-cost protections by using Relay-style (first/last) or keyset pagination arguments instead of offset-based (limit) pagination, enabling attackers to force massive, resource-exhausting database reads with queries that appear trivially cheap to the complexity analyzer. The issue carries a CVSS v4.0 base score of 8.7 (High).

Technical details

  • Root cause: The query_complexity/3 function in AshGraphql.Graphql.Resolver (lib/graphql/resolver.ex) only multiplies child query complexity by the requested page size when the argument map contains a :limit key (used for offset pagination). Relay connection arguments (first, last) and keyset pagination fall through to a catch-all clause that returns only child_complexity + 1, regardless of the actual page size requested.
  • Trigger conditions: An attacker sends a nested GraphQL query using Relay pagination on multiple levels, e.g. posts(first: 500) { edges { node { comments(first: 500) { ... } } } }. Such a query is scored as trivially inexpensive by the complexity analyzer but actually causes the resolver to materialize on the order of hundreds of thousands of rows (e.g., ~250,000 in the disclosed example), far exceeding what max_complexity limits were intended to prevent.
  • Attack vector: Network-based, requires no authentication and no user interaction (per CVSS metrics AV:N/AC:L/AT:N/PR:N/UI:N).
  • Impact: Resource exhaustion / denial of service through unbounded, amplified database reads driven entirely by attacker-controlled pagination parameters. No confidentiality or integrity impact was reported; availability impact is high (VA:H).

Affected software

  • ash_graphql (Elixir/Ash Framework GraphQL extension) versions 0.16.23 up to, but not including, 1.11.0

Severity

  • CVSS v4.0 Base Score: 8.7 (High)
  • CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • CWE-770: Allocation of Resources Without Limits or Throttling

Mitigation and recommended actions

  • Immediate: Upgrade ash_graphql to version 1.11.0 or later, which adds explicit complexity-calculation clauses for %{first: n} and %{last: n} arguments and properly clamps pagination arguments against the configured max_page_size.
  • If immediate patching is not possible:
    • Review and reduce the configured max_page_size for GraphQL resources that expose Relay or keyset pagination to limit the effective blast radius of any single query.
    • Monitor GraphQL endpoints for unusually deep, nested queries using first/last arguments combined with high page-size values, and consider rate-limiting or blocking such patterns at the API gateway/WAF layer until the upgrade is applied.
    • Audit application logs and database load metrics for signs of abnormal query cost that would indicate attempted exploitation prior to patching.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge