A critical resource exhaustion vulnerability in the ash_graphql library allows unauthenticated attackers to bypass complexity limits and trigger excessive database consumption.

This is an allocation of resources without limits or throttling (CWE-770) issue found in the query complexity calculation logic. An unauthenticated attacker can supply crafted nested Relay connection queries that are incorrectly scored as low complexity, enabling the execution of resource-intensive database operations.

The vulnerability poses a significant risk of denial of service for applications relying on the ash_graphql library. By forcing the database to materialize large datasets, an attacker can consume excessive system resources, leading to severe performance degradation or complete service unavailability. Given the CVSS score of 8.7, this is considered a high-severity issue that directly threatens system stability and availability.

Immediate Action: Update the ash_graphql library to version 1.11.0 or later to ensure proper query complexity enforcement for all pagination types.

Proactive Monitoring: Monitor database performance metrics, such as query execution time and CPU load, for spikes following GraphQL request patterns.

Compensating Controls: Implement strict rate limiting at the API gateway or Web Application Firewall (WAF) level to prevent excessive request volumes from unauthenticated sources.

Public Exploit Available: Unknown.

Organizations utilizing the ash_graphql library should prioritize upgrading to version 1.11.0 immediately. Because the vulnerability allows unauthenticated access to resource-intensive operations, the potential for service disruption is substantial. Administrators should verify their dependency versions and apply the patch as part of their next maintenance window to mitigate the risk of denial of service attacks.