Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

ash_graphql

6 known vulnerabilities (2 high, 2 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 2 high, 2 medium, 2 low
Registry
Hex

Advisories 6

  • CVE-2026-78693Medium 6.9

    Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names

    Affected: from 1.9.0, fixed in 1.11.0; from 1.9.0, fixed in 1.11.0.

  • Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read

    Affected: from 1.4.0, fixed in 1.11.0; from 1.4.0, fixed in 1.11.0.

  • Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service

    Affected: from 0.16.23, fixed in 1.11.0; from 0.16.23, fixed in 1.11.0.

  • CVE-2026-81633Medium 6.9

    Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment

    Affected: from 0.27.0, fixed in 1.11.0; from 0.27.0, fixed in 1.11.0.

  • Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

    Affected: from 1.4.0, fixed in 1.11.0; from 1.4.0, fixed in 1.11.0.

  • Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic

    Affected: from 1.4.0, fixed in 1.11.0; from 1.4.0, fixed in 1.11.0.