https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:58:44 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-82737 <p>Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.</p> <p>Ash.Vector.new/1 (lib/ash/vector.ex) encodes a vector as &lt;&lt;dim::unsigned-16, 0::unsigned-16&gt;&gt; followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. from_binary/1 later reads binary-size(dim)-unit(32) from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.</p> <p>This issue affects ash: from 2.14.13 before 3.32.2.</p> <p>Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.</p> <p>Ash.Vector.new/1 (lib/ash/vector.ex) encodes a vector as &lt;&lt;dim::unsigned-16, 0::unsigned-16&gt;&gt; followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. from_binary/1 later reads binary-size(dim)-unit(32) from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.</p> <p>This issue affects ash: from 2.14.13 before 3.32.2.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-82737