AS
Product
ash_graphql
6
CVEs
0
On KEV
8.7
Max CVSS
0
New 30D
Severity mix
Critical 0High 2Medium 2Low 2
Watch
Add ash_graphql to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-81636 | 8.7 | Aug 30 | Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service Affected: 0.16.23 before 1.11.0; d8a3e1b15587180ad9cb3ceeb398863d086c163b before c3229f6a65cbabb32fd7ffcac881922d1b3b30ad |
| CVE-2026-80223 | 7.1 | Aug 30 | Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read Affected: 1.4.0 before 1.11.0; 4c377e541a2adb6befc651f3dccc6a797bc58ba9 before 6e30b8b5a04bdeaed5d7514caa6b2d056d8d993e |
| CVE-2026-78693 | 6.9 | Aug 30 | Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names Affected: 1.9.0 before 1.11.0; 6d2d8d995906d68cc245d209a9b3f9853405eb61 before 78e90d369f09f44c534816de541e60841066a467 |
| CVE-2026-81633 | 6.9 | Aug 30 | Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment Affected: 0.27.0 before 1.11.0; 365b3aedc6b36f020e6a2c7dce63fa569243bc4e before c8863ed8e5c21f1bfb6125f1d24e78443dfc6351 |
| CVE-2026-81643 | 2.3 | Aug 30 | Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification Affected: 1.4.0 before 1.11.0; 3cb2c9870d050c7c4bba6c211aaed97d732f7e81 before e8e67f39add2ce0771e6db5f086afe68ba212c57 |
| CVE-2026-82367 | 2.3 | Aug 30 | Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic Affected: 1.4.0 before 1.11.0; 3cb2c9870d050c7c4bba6c211aaed97d732f7e81 before b798ef5288664a0261990b19765558f168b718fb |
Showing 6