Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution…
CVSS 4.0HIGH 7.5·Local·No auth·No interaction·EPSS 0.00611·Published 2026-08-12·Fixed in 3.31.3CWE-502
Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor.
CVSS 4.0MEDIUM 5.9·Local·No auth·No interaction·EPSS 0.00358·Published 2026-08-09·Fixed in 3.31.1CWE-502