EEF-CVE-2026-82760
- Source
- https://cna.erlef.org/osv/EEF-CVE-2026-82760.html
- Import Source
- https://cna.erlef.org/osv/EEF-CVE-2026-82760.json
- JSON Data
- https://api.osv.dev/v1/vulns/EEF-CVE-2026-82760
- Aliases
-
- CVE-2026-82760
- GHSA-q876-xr24-2mcx
- Published
- 2026-09-17T13:08:46Z
- Modified
- 2026-09-17T13:26:04Z
- Severity
-
- 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in
- Details
-
Summary
Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key.
AshAuthentication.Base.decode62/1inlib/ash_authentication/base.exsplits its argument into one binary per character and folds it withcharval62/2, which recomputesInteger.pow(62, index)at every position instead of accumulating by Horner's method, so cost grows roughly cubically in the input length.bindecode62/1in the same module is quadratic throughInteger.undigits/2andInteger.digits/2. Neither function capsbyte_size/1, andAshAuthentication.Strategy.ApiKey.SignInPreparationpasses the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surroundingrescueclauses catch exceptions, not CPU or memory exhaustion.This issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
- Database specific
{ "capec_ids": [ "CAPEC-130" ], "cpe_ids": [ "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*" ], "cwe_ids": [ "CWE-407" ] }- References
-
- https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-q876-xr24-2mcx
- https://cna.erlef.org/cves/CVE-2026-82760.html
- https://github.com/team-alembic/ash_authentication/commit/f3a53f480088419788d5c3934af3131fa9066773
- https://github.com/team-alembic/ash_authentication/commit/d5a5d4cb5cc17fbd6e2a120a6111b47accad4b8e
- https://github.com/team-alembic/ash_authentication/commit/dfb19c897853686ab481c5e773f7a1a0c74dea04
- https://hex.pm/packages/ash_authentication
- Credits
-
-
- Peter Ullrich - REPORTER
-
- James Harton - REMEDIATION_DEVELOPER
-
- Jonatan Männchen / EEF - ANALYST
-
Affected packages
Hex / ash_authentication
Package
- Name
- ash_authentication
- Purl
- pkg:hex/ash_authentication
Affected ranges
- Type
- SEMVER
- Events
-
Introduced4.8.0Fixed4.15.0
- Type
- SEMVER
- Events
-
Introduced5.0.0-rc.0Fixed5.0.0-rc.14