Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
140 vulnerabilities by ash-project
CVE-2026-82747 (GCVE-0-2026-82747)
Vulnerability from nvd – Published: 2026-09-01 04:14 – Updated: 2026-09-01 12:36
VLAI
EPSS
VEX
Title
Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
Summary
Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.
When a resource has an access_type :runtime read policy (a check evaluated per record rather than compiled to a filter), Ash.Policy.Authorizer decides each record in check_result/1 (lib/ash/policy/authorizer/authorizer.ex) by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record ({[record | data], authorizer, any_forbidden?}) and returned it as authorized. As a result, records the runtime read policy denies are returned to any actor. The fix forbids a record whose scenarios are all impossible.
This issue affects ash: from 3.4.44 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:36 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82747.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82747 | related |
| https://github.com/ash-project/ash/commit/6eddb8a… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.4.44 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
f4a8ff53fd3b974468d73685cd3fc842ef893de3 , < 6eddb8ab26e45023faf0c79ebd152bb40aefda02
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82747",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:36:21.694323Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:36:50.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-4259-gvr2-4xhq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Policy.Authorizer\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/policy/authorizer/authorizer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Policy.Authorizer\u0027:check_result/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "3.4.44",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Policy.Authorizer\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/policy/authorizer/authorizer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Policy.Authorizer\u0027:check_result/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "6eddb8ab26e45023faf0c79ebd152bb40aefda02",
"status": "affected",
"version": "f4a8ff53fd3b974468d73685cd3fc842ef893de3",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "3.4.44",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.\u003c/p\u003e\n\u003cp\u003eWhen a resource has an \u003ccode\u003eaccess_type :runtime\u003c/code\u003e read policy (a check evaluated per record rather than compiled to a filter), \u003ccode\u003eAsh.Policy.Authorizer\u003c/code\u003e decides each record in \u003ccode\u003echeck_result/1\u003c/code\u003e (\u003ccode\u003elib/ash/policy/authorizer/authorizer.ex\u003c/code\u003e) by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record (\u003ccode\u003e{[record | data], authorizer, any_forbidden?}\u003c/code\u003e) and returned it as authorized. As a result, records the runtime read policy denies are returned to any actor. The fix forbids a record whose scenarios are all impossible.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.4.44 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.\n\nWhen a resource has an `access_type :runtime` read policy (a check evaluated per record rather than compiled to a filter), `Ash.Policy.Authorizer` decides each record in `check_result/1` (`lib/ash/policy/authorizer/authorizer.ex`) by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record (`{[record | data], authorizer, any_forbidden?}`) and returned it as authorized. As a result, records the runtime read policy denies are returned to any actor. The fix forbids a record whose scenarios are all impossible.\n\nThis issue affects ash: from 3.4.44 before 3.32.2."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.\n\nWhen a resource has an access_type :runtime read policy (a check evaluated per record rather than compiled to a filter), Ash.Policy.Authorizer decides each record in check_result/1 (lib/ash/policy/authorizer/authorizer.ex) by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record ({[record | data], authorizer, any_forbidden?}) and returned it as authorized. As a result, records the runtime read policy denies are returned to any actor. The fix forbids a record whose scenarios are all impossible.\n\nThis issue affects ash: from 3.4.44 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T04:14:57.840Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-4259-gvr2-4xhq"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82747.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82747"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/6eddb8ab26e45023faf0c79ebd152bb40aefda02"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82747",
"datePublished": "2026-09-01T04:14:57.840Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T12:36:50.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82749 (GCVE-0-2026-82749)
Vulnerability from nvd – Published: 2026-09-01 03:54 – Updated: 2026-09-01 12:38
VLAI
EPSS
VEX
Title
Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records
Summary
Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match unintended records when the referenced parent field cannot be resolved.
Loading a relationship whose filter references parent(...) resolves that expression against the parent record. resolve_parent_in_filter/3 (lib/ash/actions/read/relationships.ex) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to nil rather than failing. A scoping predicate such as org_id == parent(org_id) then becomes an IS NULL match, and a guard like is_nil(parent(org_id)) or org_id == parent(org_id) activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a parent(...) reference cannot be resolved, instead of defaulting to nil.
This issue affects ash: from 3.13.2 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:37 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82749.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82749 | related |
| https://github.com/ash-project/ash/commit/e52dad2… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.13.2 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
0ddff26e6e6bc6d182e1af2f98b431575e5b4179 , < e52dad2c39a35f6f043f7324d26e4f4e2551dfd2
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82749",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:37:51.333023Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:38:27.534Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-j8fx-ff37-4j9c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/read/relationships.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:resolve_parent_in_filter/3"
},
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:do_per_record_no_attributes_load/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "3.13.2",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/read/relationships.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:resolve_parent_in_filter/3"
},
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:do_per_record_no_attributes_load/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "e52dad2c39a35f6f043f7324d26e4f4e2551dfd2",
"status": "affected",
"version": "0ddff26e6e6bc6d182e1af2f98b431575e5b4179",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "3.13.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash widens a relationship\u0027s \u003ccode\u003eparent(...)\u003c/code\u003e scoping filter to match unintended records when the referenced parent field cannot be resolved.\u003c/p\u003e\n\u003cp\u003eLoading a relationship whose filter references \u003ccode\u003eparent(...)\u003c/code\u003e resolves that expression against the parent record. \u003ccode\u003eresolve_parent_in_filter/3\u003c/code\u003e (\u003ccode\u003elib/ash/actions/read/relationships.ex\u003c/code\u003e) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to \u003ccode\u003enil\u003c/code\u003e rather than failing. A scoping predicate such as \u003ccode\u003eorg_id == parent(org_id)\u003c/code\u003e then becomes an \u003ccode\u003eIS NULL\u003c/code\u003e match, and a guard like \u003ccode\u003eis_nil(parent(org_id)) or org_id == parent(org_id)\u003c/code\u003e activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a \u003ccode\u003eparent(...)\u003c/code\u003e reference cannot be resolved, instead of defaulting to nil.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.13.2 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash widens a relationship\u0027s `parent(...)` scoping filter to match unintended records when the referenced parent field cannot be resolved.\n\nLoading a relationship whose filter references `parent(...)` resolves that expression against the parent record. `resolve_parent_in_filter/3` (`lib/ash/actions/read/relationships.ex`) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to `nil` rather than failing. A scoping predicate such as `org_id == parent(org_id)` then becomes an `IS NULL` match, and a guard like `is_nil(parent(org_id)) or org_id == parent(org_id)` activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a `parent(...)` reference cannot be resolved, instead of defaulting to nil.\n\nThis issue affects ash: from 3.13.2 before 3.32.2."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash widens a relationship\u0027s parent(...) scoping filter to match unintended records when the referenced parent field cannot be resolved.\n\nLoading a relationship whose filter references parent(...) resolves that expression against the parent record. resolve_parent_in_filter/3 (lib/ash/actions/read/relationships.ex) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to nil rather than failing. A scoping predicate such as org_id == parent(org_id) then becomes an IS NULL match, and a guard like is_nil(parent(org_id)) or org_id == parent(org_id) activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a parent(...) reference cannot be resolved, instead of defaulting to nil.\n\nThis issue affects ash: from 3.13.2 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:54:12.716Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-j8fx-ff37-4j9c"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82749.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82749"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/e52dad2c39a35f6f043f7324d26e4f4e2551dfd2"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82749",
"datePublished": "2026-09-01T03:54:12.716Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T12:38:27.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82748 (GCVE-0-2026-82748)
Vulnerability from nvd – Published: 2026-09-01 03:52 – Updated: 2026-09-01 15:17
VLAI
EPSS
VEX
Title
Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another
Summary
Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against.
Ash.Actions.Aggregate groups aggregates by their {authorize?, read_action} and authorizes each group under that read action, but when building the data query it selected the action as opts[:action] || read_action || <primary read> (lib/ash/actions/aggregate.ex). When a caller passed an :action option, the aggregate query ran under that action while authorization had been computed for the group's own read_action. If the run action's read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action's policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same read_action it is authorized against.
This issue affects ash: from 3.5.13 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:17 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82748.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82748 | related |
| https://github.com/ash-project/ash/commit/2d9b78b… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.5.13 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
d2e99980380cad610dbab3c4167e85323244bc71 , < 2d9b78b87d2dc72885a8aa1d660b478d42f749f7
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82748",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:17:28.654451Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:17:47.434Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-g5hp-mghm-3mgp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Aggregate\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/aggregate.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Aggregate\u0027:run/4"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "3.5.13",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Aggregate\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/aggregate.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Aggregate\u0027:run/4"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2d9b78b87d2dc72885a8aa1d660b478d42f749f7",
"status": "affected",
"version": "d2e99980380cad610dbab3c4167e85323244bc71",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "3.5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Actions.Aggregate\u003c/code\u003e groups aggregates by their \u003ccode\u003e{authorize?, read_action}\u003c/code\u003e and authorizes each group under that read action, but when building the data query it selected the action as \u003ccode\u003eopts[:action] || read_action || \u0026lt;primary read\u0026gt;\u003c/code\u003e (\u003ccode\u003elib/ash/actions/aggregate.ex\u003c/code\u003e). When a caller passed an \u003ccode\u003e:action\u003c/code\u003e option, the aggregate query ran under that action while authorization had been computed for the group\u0027s own \u003ccode\u003eread_action\u003c/code\u003e. If the run action\u0027s read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action\u0027s policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same \u003ccode\u003eread_action\u003c/code\u003e it is authorized against.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.5.13 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against.\n\n`Ash.Actions.Aggregate` groups aggregates by their `{authorize?, read_action}` and authorizes each group under that read action, but when building the data query it selected the action as `opts[:action] || read_action || \u003cprimary read\u003e` (`lib/ash/actions/aggregate.ex`). When a caller passed an `:action` option, the aggregate query ran under that action while authorization had been computed for the group\u0027s own `read_action`. If the run action\u0027s read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action\u0027s policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same `read_action` it is authorized against.\n\nThis issue affects ash: from 3.5.13 before 3.32.2."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against.\n\nAsh.Actions.Aggregate groups aggregates by their {authorize?, read_action} and authorizes each group under that read action, but when building the data query it selected the action as opts[:action] || read_action || \u003cprimary read\u003e (lib/ash/actions/aggregate.ex). When a caller passed an :action option, the aggregate query ran under that action while authorization had been computed for the group\u0027s own read_action. If the run action\u0027s read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action\u0027s policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same read_action it is authorized against.\n\nThis issue affects ash: from 3.5.13 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:52:01.686Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-g5hp-mghm-3mgp"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82748.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82748"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/2d9b78b87d2dc72885a8aa1d660b478d42f749f7"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82748",
"datePublished": "2026-09-01T03:52:01.686Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T15:17:47.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82746 (GCVE-0-2026-82746)
Vulnerability from nvd – Published: 2026-09-01 03:47 – Updated: 2026-09-01 15:17
VLAI
EPSS
VEX
Title
Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records
Summary
Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.update_many/4.
Ash.update_many/4 runs as a single atomic statement (a data-layer update_many, for example a SQL MERGE) whenever an atomic strategy is used and the data layer supports it. Ash.Actions.Update.UpdateMany (lib/ash/actions/update/update_many.ex) took that path even under authorize?: true without applying the resource's policies, so the statement updated every row matched by primary key regardless of the policy filter that authorization would impose. An actor could therefore update records the policies forbid, such as rows belonging to another actor or tenant. The fix restricts the atomic path to data layers supporting changeset filters when authorizing, authorizes each changeset, and merges the resulting policy filter into each changeset so the statement only touches authorized rows.
This issue affects ash: from 3.29.0 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:16 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82746.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82746 | related |
| https://github.com/ash-project/ash/commit/ed4e656… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.29.0 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
45e6b4ec7b2dc076afe614aa7aef7e1f15b5e335 , < ed4e656822ffe83f8e960d5de0b573c0d1ae7f29
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82746",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:16:54.224249Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:17:12.056Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-j7c9-3fw3-jc64"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Update.UpdateMany\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/update/update_many.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Update.UpdateMany\u0027:run/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "3.29.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Update.UpdateMany\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/update/update_many.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Update.UpdateMany\u0027:run/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "ed4e656822ffe83f8e960d5de0b573c0d1ae7f29",
"status": "affected",
"version": "45e6b4ec7b2dc076afe614aa7aef7e1f15b5e335",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "3.29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of \u003ccode\u003eAsh.update_many/4\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.update_many/4\u003c/code\u003e runs as a single atomic statement (a data-layer \u003ccode\u003eupdate_many\u003c/code\u003e, for example a SQL MERGE) whenever an atomic strategy is used and the data layer supports it. \u003ccode\u003eAsh.Actions.Update.UpdateMany\u003c/code\u003e (\u003ccode\u003elib/ash/actions/update/update_many.ex\u003c/code\u003e) took that path even under \u003ccode\u003eauthorize?: true\u003c/code\u003e without applying the resource\u0027s policies, so the statement updated every row matched by primary key regardless of the policy filter that authorization would impose. An actor could therefore update records the policies forbid, such as rows belonging to another actor or tenant. The fix restricts the atomic path to data layers supporting changeset filters when authorizing, authorizes each changeset, and merges the resulting policy filter into each changeset so the statement only touches authorized rows.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.29.0 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of `Ash.update_many/4`.\n\n`Ash.update_many/4` runs as a single atomic statement (a data-layer `update_many`, for example a SQL MERGE) whenever an atomic strategy is used and the data layer supports it. `Ash.Actions.Update.UpdateMany` (`lib/ash/actions/update/update_many.ex`) took that path even under `authorize?: true` without applying the resource\u0027s policies, so the statement updated every row matched by primary key regardless of the policy filter that authorization would impose. An actor could therefore update records the policies forbid, such as rows belonging to another actor or tenant. The fix restricts the atomic path to data layers supporting changeset filters when authorizing, authorizes each changeset, and merges the resulting policy filter into each changeset so the statement only touches authorized rows.\n\nThis issue affects ash: from 3.29.0 before 3.32.2."
}
],
"value": "Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.update_many/4.\n\nAsh.update_many/4 runs as a single atomic statement (a data-layer update_many, for example a SQL MERGE) whenever an atomic strategy is used and the data layer supports it. Ash.Actions.Update.UpdateMany (lib/ash/actions/update/update_many.ex) took that path even under authorize?: true without applying the resource\u0027s policies, so the statement updated every row matched by primary key regardless of the policy filter that authorization would impose. An actor could therefore update records the policies forbid, such as rows belonging to another actor or tenant. The fix restricts the atomic path to data layers supporting changeset filters when authorizing, authorizes each changeset, and merges the resulting policy filter into each changeset so the statement only touches authorized rows.\n\nThis issue affects ash: from 3.29.0 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:47:14.278Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-j7c9-3fw3-jc64"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82746.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82746"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/ed4e656822ffe83f8e960d5de0b573c0d1ae7f29"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82746",
"datePublished": "2026-09-01T03:47:14.278Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T15:17:12.056Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82745 (GCVE-0-2026-82745)
Vulnerability from nvd – Published: 2026-09-01 03:42 – Updated: 2026-09-01 15:16
VLAI
EPSS
VEX
Title
ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness
Summary
Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert.
Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ETS and Mnesia data layers implemented create as a keyed insert that replaces any existing entry with the same primary key (lib/ash/data_layer/ets/ets.ex, lib/ash/data_layer/mnesia/mnesia.ex). An actor who can set the primary key on a create (for example a user-supplied string or integer key) can submit a create whose key matches an existing record and silently overwrite it, destroying and replacing another entity's data without going through the update action or its policies. The fix rejects a create whose primary key already exists with an already-taken error, and only allows duplicates for keyless resources.
This issue affects ash: from 0.4.0 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:16 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82745.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82745 | related |
| https://github.com/ash-project/ash/commit/912e243… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
0.4.0 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
6dc699d8a683d542812b34a8c104cc90164add3a , < 912e243196017c2a812c25905c2b1cc3bbb843fc
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82745",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:16:19.826687Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:16:38.003Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-92x7-q3h5-wf88"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.DataLayer.Ets\u0027",
"\u0027Elixir.Ash.DataLayer.Mnesia\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/data_layer/ets/ets.ex",
"lib/ash/data_layer/mnesia/mnesia.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.DataLayer.Ets\u0027:create/2"
},
{
"name": "\u0027Elixir.Ash.DataLayer.Mnesia\u0027:create/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "0.4.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.DataLayer.Ets\u0027",
"\u0027Elixir.Ash.DataLayer.Mnesia\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/data_layer/ets/ets.ex",
"lib/ash/data_layer/mnesia/mnesia.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.DataLayer.Ets\u0027:create/2"
},
{
"name": "\u0027Elixir.Ash.DataLayer.Mnesia\u0027:create/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "912e243196017c2a812c25905c2b1cc3bbb843fc",
"status": "affected",
"version": "6dc699d8a683d542812b34a8c104cc90164add3a",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "0.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert.\u003c/p\u003e\n\u003cp\u003eUnlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ETS and Mnesia data layers implemented \u003ccode\u003ecreate\u003c/code\u003e as a keyed insert that replaces any existing entry with the same primary key (\u003ccode\u003elib/ash/data_layer/ets/ets.ex\u003c/code\u003e, \u003ccode\u003elib/ash/data_layer/mnesia/mnesia.ex\u003c/code\u003e). An actor who can set the primary key on a create (for example a user-supplied string or integer key) can submit a create whose key matches an existing record and silently overwrite it, destroying and replacing another entity\u0027s data without going through the update action or its policies. The fix rejects a create whose primary key already exists with an already-taken error, and only allows duplicates for keyless resources.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 0.4.0 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert.\n\nUnlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ETS and Mnesia data layers implemented `create` as a keyed insert that replaces any existing entry with the same primary key (`lib/ash/data_layer/ets/ets.ex`, `lib/ash/data_layer/mnesia/mnesia.ex`). An actor who can set the primary key on a create (for example a user-supplied string or integer key) can submit a create whose key matches an existing record and silently overwrite it, destroying and replacing another entity\u0027s data without going through the update action or its policies. The fix rejects a create whose primary key already exists with an already-taken error, and only allows duplicates for keyless resources.\n\nThis issue affects ash: from 0.4.0 before 3.32.2."
}
],
"value": "Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert.\n\nUnlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ETS and Mnesia data layers implemented create as a keyed insert that replaces any existing entry with the same primary key (lib/ash/data_layer/ets/ets.ex, lib/ash/data_layer/mnesia/mnesia.ex). An actor who can set the primary key on a create (for example a user-supplied string or integer key) can submit a create whose key matches an existing record and silently overwrite it, destroying and replacing another entity\u0027s data without going through the update action or its policies. The fix rejects a create whose primary key already exists with an already-taken error, and only allows duplicates for keyless resources.\n\nThis issue affects ash: from 0.4.0 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:42:28.309Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-92x7-q3h5-wf88"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82745.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82745"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/912e243196017c2a812c25905c2b1cc3bbb843fc"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82745",
"datePublished": "2026-09-01T03:42:28.309Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T15:16:38.003Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82744 (GCVE-0-2026-82744)
Vulnerability from nvd – Published: 2026-09-01 03:39 – Updated: 2026-09-01 15:15
VLAI
EPSS
VEX
Title
Ash.Reactor change step fails open, skipping a change when its where guard raises
Summary
Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not.
An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex) evaluated those guards in apply_where_clauses/3, and apply_validation rescued any exception into {:error, error}. The reduce treated that identically to a guard whose condition was simply not met and bypassed the change. So when a guard raises (for example on attacker-influenced input), a change that enforces a security-relevant modification is skipped rather than failing the step. The fix distinguishes a raised exception (now {:raised, error}) and halts the step with an error, failing closed.
This issue affects ash: from 3.0.0-rc.17 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:15 UTC
CWE
- CWE-636 - Not Failing Securely ('Failing Open')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82744.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82744 | related |
| https://github.com/ash-project/ash/commit/6d2eb86… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.0.0-rc.17 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
321f43bd05ad9544e693cbf797243693e51a6be4 , < 6d2eb86ea8d2ba5ffac89c1b8b9bf46e331feabc
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82744",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:15:37.062501Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:15:56.042Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-3xq4-m876-fr88"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Reactor.ChangeStep\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/reactor/steps/change_step.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Reactor.ChangeStep\u0027:apply_where_clauses/3"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "3.0.0-rc.17",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Reactor.ChangeStep\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/reactor/steps/change_step.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Reactor.ChangeStep\u0027:apply_where_clauses/3"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "6d2eb86ea8d2ba5ffac89c1b8b9bf46e331feabc",
"status": "affected",
"version": "321f43bd05ad9544e693cbf797243693e51a6be4",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "3.0.0-rc.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNot Failing Securely (Failing Open) vulnerability in ash-project ash skips an \u003ccode\u003eAsh.Reactor\u003c/code\u003e change when the guard controlling it raises, so a change meant to run does not.\u003c/p\u003e\n\u003cp\u003eAn \u003ccode\u003eAsh.Reactor\u003c/code\u003e \u003ccode\u003echange\u003c/code\u003e step can be gated by \u003ccode\u003ewhere\u003c/code\u003e validations that decide whether the change runs. \u003ccode\u003eAsh.Reactor.ChangeStep\u003c/code\u003e (\u003ccode\u003elib/ash/reactor/steps/change_step.ex\u003c/code\u003e) evaluated those guards in \u003ccode\u003eapply_where_clauses/3\u003c/code\u003e, and \u003ccode\u003eapply_validation\u003c/code\u003e rescued any exception into \u003ccode\u003e{:error, error}\u003c/code\u003e. The reduce treated that identically to a guard whose condition was simply not met and bypassed the change. So when a guard raises (for example on attacker-influenced input), a change that enforces a security-relevant modification is skipped rather than failing the step. The fix distinguishes a raised exception (now \u003ccode\u003e{:raised, error}\u003c/code\u003e) and halts the step with an error, failing closed.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.0.0-rc.17 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an `Ash.Reactor` change when the guard controlling it raises, so a change meant to run does not.\n\nAn `Ash.Reactor` `change` step can be gated by `where` validations that decide whether the change runs. `Ash.Reactor.ChangeStep` (`lib/ash/reactor/steps/change_step.ex`) evaluated those guards in `apply_where_clauses/3`, and `apply_validation` rescued any exception into `{:error, error}`. The reduce treated that identically to a guard whose condition was simply not met and bypassed the change. So when a guard raises (for example on attacker-influenced input), a change that enforces a security-relevant modification is skipped rather than failing the step. The fix distinguishes a raised exception (now `{:raised, error}`) and halts the step with an error, failing closed.\n\nThis issue affects ash: from 3.0.0-rc.17 before 3.32.2."
}
],
"value": "Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not.\n\nAn Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex) evaluated those guards in apply_where_clauses/3, and apply_validation rescued any exception into {:error, error}. The reduce treated that identically to a guard whose condition was simply not met and bypassed the change. So when a guard raises (for example on attacker-influenced input), a change that enforces a security-relevant modification is skipped rather than failing the step. The fix distinguishes a raised exception (now {:raised, error}) and halts the step with an error, failing closed.\n\nThis issue affects ash: from 3.0.0-rc.17 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-636",
"description": "CWE-636 Not Failing Securely (\u0027Failing Open\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:39:42.668Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-3xq4-m876-fr88"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82744.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82744"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/6d2eb86ea8d2ba5ffac89c1b8b9bf46e331feabc"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Reactor change step fails open, skipping a change when its where guard raises"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82744",
"datePublished": "2026-09-01T03:39:42.668Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T15:15:56.042Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82743 (GCVE-0-2026-82743)
Vulnerability from nvd – Published: 2026-09-01 03:37 – Updated: 2026-09-01 12:40
VLAI
EPSS
VEX
Title
Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads
Summary
Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it.
Ash.Actions.Read.AsyncLimiter.await_at_least_one/1 (lib/ash/actions/read/async_limiter.ex) waited for concurrent async read tasks by polling each with Task.yield(task, 0) in a tight loop rather than blocking. While every outstanding task is still running (a slow related-data load or calculation), the loop returns immediately and repeats, busy-spinning and holding a BEAM scheduler at full CPU for the whole duration of the slow read; concurrent slow reads tie up further schedulers. The fix waits with Task.yield_many (a non-blocking sweep followed by a blocking wait with timeout: :infinity), so the process sleeps until a task completes instead of spinning.
This issue affects ash: from 2.19.0 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:39 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82743.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82743 | related |
| https://github.com/ash-project/ash/commit/0a5ecd2… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.19.0 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
c48cb08026cf56b1ac33209203bc9c00061b40b8 , < 0a5ecd2ffdfa848afdeb8827f02982ef2a63a1cd
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82743",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:39:40.600101Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:40:17.592Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-33wq-x3q2-c92h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Read.AsyncLimiter\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/read/async_limiter.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Read.AsyncLimiter\u0027:await_at_least_one/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "2.19.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Read.AsyncLimiter\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/read/async_limiter.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Read.AsyncLimiter\u0027:await_at_least_one/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0a5ecd2ffdfa848afdeb8827f02982ef2a63a1cd",
"status": "affected",
"version": "c48cb08026cf56b1ac33209203bc9c00061b40b8",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "2.19.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Actions.Read.AsyncLimiter.await_at_least_one/1\u003c/code\u003e (\u003ccode\u003elib/ash/actions/read/async_limiter.ex\u003c/code\u003e) waited for concurrent async read tasks by polling each with \u003ccode\u003eTask.yield(task, 0)\u003c/code\u003e in a tight loop rather than blocking. While every outstanding task is still running (a slow related-data load or calculation), the loop returns immediately and repeats, busy-spinning and holding a BEAM scheduler at full CPU for the whole duration of the slow read; concurrent slow reads tie up further schedulers. The fix waits with \u003ccode\u003eTask.yield_many\u003c/code\u003e (a non-blocking sweep followed by a blocking wait with \u003ccode\u003etimeout: :infinity\u003c/code\u003e), so the process sleeps until a task completes instead of spinning.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.19.0 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it.\n\n`Ash.Actions.Read.AsyncLimiter.await_at_least_one/1` (`lib/ash/actions/read/async_limiter.ex`) waited for concurrent async read tasks by polling each with `Task.yield(task, 0)` in a tight loop rather than blocking. While every outstanding task is still running (a slow related-data load or calculation), the loop returns immediately and repeats, busy-spinning and holding a BEAM scheduler at full CPU for the whole duration of the slow read; concurrent slow reads tie up further schedulers. The fix waits with `Task.yield_many` (a non-blocking sweep followed by a blocking wait with `timeout: :infinity`), so the process sleeps until a task completes instead of spinning.\n\nThis issue affects ash: from 2.19.0 before 3.32.2."
}
],
"value": "Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it.\n\nAsh.Actions.Read.AsyncLimiter.await_at_least_one/1 (lib/ash/actions/read/async_limiter.ex) waited for concurrent async read tasks by polling each with Task.yield(task, 0) in a tight loop rather than blocking. While every outstanding task is still running (a slow related-data load or calculation), the loop returns immediately and repeats, busy-spinning and holding a BEAM scheduler at full CPU for the whole duration of the slow read; concurrent slow reads tie up further schedulers. The fix waits with Task.yield_many (a non-blocking sweep followed by a blocking wait with timeout: :infinity), so the process sleeps until a task completes instead of spinning.\n\nThis issue affects ash: from 2.19.0 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-227",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-227 Sustained Client Engagement"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:37:24.292Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-33wq-x3q2-c92h"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82743.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82743"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/0a5ecd2ffdfa848afdeb8827f02982ef2a63a1cd"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82743",
"datePublished": "2026-09-01T03:37:24.292Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T12:40:17.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82742 (GCVE-0-2026-82742)
Vulnerability from nvd – Published: 2026-09-01 03:35 – Updated: 2026-09-01 12:41
VLAI
EPSS
VEX
Title
Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory
Summary
Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory.
Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its related rows. flatten_relationships/2 (lib/ash/filter/runtime.ex) eagerly built the full Cartesian product across the filter's to-many relationship paths, so a record with K to-many relationships of M rows each materialized on the order of M^K scenarios before any predicate was checked. A filter or dataset that reaches several sizeable to-many relationships therefore allocates memory combinatorially and can exhaust the node. The fix streams the expansion lazily and short-circuits on the first matching scenario, bounding the work.
This issue affects ash: from 1.29.0-rc0 before 3.32.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:41 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82742.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82742 | related |
| https://github.com/ash-project/ash/commit/da07f00… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
1.29.0-rc0 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
f6f5d194bfc7802bd32e48bf2eabd2d97a0109a4 , < da07f009e889819ec410fa1f0f12534bfb9e21dd
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82742",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:41:35.557359Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:41:53.189Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Filter.Runtime\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/filter/runtime.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Filter.Runtime\u0027:filter_matches/4"
},
{
"name": "\u0027Elixir.Ash.Filter.Runtime\u0027:flatten_relationships/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "1.29.0-rc0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Filter.Runtime\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/filter/runtime.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Filter.Runtime\u0027:filter_matches/4"
},
{
"name": "\u0027Elixir.Ash.Filter.Runtime\u0027:flatten_relationships/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "da07f009e889819ec410fa1f0f12534bfb9e21dd",
"status": "affected",
"version": "f6f5d194bfc7802bd32e48bf2eabd2d97a0109a4",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "1.29.0-rc0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Filter.Runtime\u003c/code\u003e matches a filter against an in-memory record by first expanding the record into combinations of its related rows. \u003ccode\u003eflatten_relationships/2\u003c/code\u003e (\u003ccode\u003elib/ash/filter/runtime.ex\u003c/code\u003e) eagerly built the full Cartesian product across the filter\u0027s to-many relationship paths, so a record with K to-many relationships of M rows each materialized on the order of M^K scenarios before any predicate was checked. A filter or dataset that reaches several sizeable to-many relationships therefore allocates memory combinatorially and can exhaust the node. The fix streams the expansion lazily and short-circuits on the first matching scenario, bounding the work.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 1.29.0-rc0 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory.\n\n`Ash.Filter.Runtime` matches a filter against an in-memory record by first expanding the record into combinations of its related rows. `flatten_relationships/2` (`lib/ash/filter/runtime.ex`) eagerly built the full Cartesian product across the filter\u0027s to-many relationship paths, so a record with K to-many relationships of M rows each materialized on the order of M^K scenarios before any predicate was checked. A filter or dataset that reaches several sizeable to-many relationships therefore allocates memory combinatorially and can exhaust the node. The fix streams the expansion lazily and short-circuits on the first matching scenario, bounding the work.\n\nThis issue affects ash: from 1.29.0-rc0 before 3.32.2."
}
],
"value": "Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory.\n\nAsh.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its related rows. flatten_relationships/2 (lib/ash/filter/runtime.ex) eagerly built the full Cartesian product across the filter\u0027s to-many relationship paths, so a record with K to-many relationships of M rows each materialized on the order of M^K scenarios before any predicate was checked. A filter or dataset that reaches several sizeable to-many relationships therefore allocates memory combinatorially and can exhaust the node. The fix streams the expansion lazily and short-circuits on the first matching scenario, bounding the work.\n\nThis issue affects ash: from 1.29.0-rc0 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:35:18.551Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-mgwj-c69v-6f83"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82742.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82742"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/da07f009e889819ec410fa1f0f12534bfb9e21dd"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82742",
"datePublished": "2026-09-01T03:35:18.551Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T12:41:53.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82741 (GCVE-0-2026-82741)
Vulnerability from nvd – Published: 2026-09-01 03:33 – Updated: 2026-09-01 15:13
VLAI
EPSS
VEX
Title
Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion
Summary
Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :map_with_tag, bypassing that member's validation and any tag-based authorization.
For a union with storage: :map_with_tag, each member is identified in storage by a configured tag and tag_value. Ash.Type.Union.dump_to_native/2 (lib/ash/type/union.ex) did not force the configured tag when writing the value, so a tag carried in the submitted value was persisted verbatim. An attacker can therefore store a value whose data belongs to one member but whose tag names a different member. On read the value is re-selected by its tag and treated as the incompatible member (a type confusion), bypassing the real member's constraints and any logic or policy that branches on the union tag. The fix drops any incoming tag and forces the configured tag value on dump.
This issue affects ash: from 2.14.18 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:12 UTC
CWE
- CWE-1287 - Improper Validation of Specified Type of Input
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82741.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82741 | related |
| https://github.com/ash-project/ash/commit/8dbdaec… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.14.18 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
b0bd2d23d979e731610327636f51da4981fcef68 , < 8dbdaecd0f115f52e7c3f9a3e798617d6fbf5f7d
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82741",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:12:48.327448Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:13:10.142Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-2mmm-gc86-7jgg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.Union\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/union.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.Union\u0027:dump_to_native/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "2.14.18",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.Union\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/union.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.Union\u0027:dump_to_native/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "8dbdaecd0f115f52e7c3f9a3e798617d6fbf5f7d",
"status": "affected",
"version": "b0bd2d23d979e731610327636f51da4981fcef68",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "2.14.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an \u003ccode\u003eAsh.Type.Union\u003c/code\u003e value that uses \u003ccode\u003estorage: :map_with_tag\u003c/code\u003e, bypassing that member\u0027s validation and any tag-based authorization.\u003c/p\u003e\n\u003cp\u003eFor a union with \u003ccode\u003estorage: :map_with_tag\u003c/code\u003e, each member is identified in storage by a configured \u003ccode\u003etag\u003c/code\u003e and \u003ccode\u003etag_value\u003c/code\u003e. \u003ccode\u003eAsh.Type.Union.dump_to_native/2\u003c/code\u003e (\u003ccode\u003elib/ash/type/union.ex\u003c/code\u003e) did not force the configured tag when writing the value, so a tag carried in the submitted value was persisted verbatim. An attacker can therefore store a value whose data belongs to one member but whose tag names a different member. On read the value is re-selected by its tag and treated as the incompatible member (a type confusion), bypassing the real member\u0027s constraints and any logic or policy that branches on the union tag. The fix drops any incoming tag and forces the configured tag value on dump.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.14.18 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an `Ash.Type.Union` value that uses `storage: :map_with_tag`, bypassing that member\u0027s validation and any tag-based authorization.\n\nFor a union with `storage: :map_with_tag`, each member is identified in storage by a configured `tag` and `tag_value`. `Ash.Type.Union.dump_to_native/2` (`lib/ash/type/union.ex`) did not force the configured tag when writing the value, so a tag carried in the submitted value was persisted verbatim. An attacker can therefore store a value whose data belongs to one member but whose tag names a different member. On read the value is re-selected by its tag and treated as the incompatible member (a type confusion), bypassing the real member\u0027s constraints and any logic or policy that branches on the union tag. The fix drops any incoming tag and forces the configured tag value on dump.\n\nThis issue affects ash: from 2.14.18 before 3.32.2."
}
],
"value": "Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :map_with_tag, bypassing that member\u0027s validation and any tag-based authorization.\n\nFor a union with storage: :map_with_tag, each member is identified in storage by a configured tag and tag_value. Ash.Type.Union.dump_to_native/2 (lib/ash/type/union.ex) did not force the configured tag when writing the value, so a tag carried in the submitted value was persisted verbatim. An attacker can therefore store a value whose data belongs to one member but whose tag names a different member. On read the value is re-selected by its tag and treated as the incompatible member (a type confusion), bypassing the real member\u0027s constraints and any logic or policy that branches on the union tag. The fix drops any incoming tag and forces the configured tag value on dump.\n\nThis issue affects ash: from 2.14.18 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1287",
"description": "CWE-1287 Improper Validation of Specified Type of Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:33:03.442Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-2mmm-gc86-7jgg"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82741.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82741"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/8dbdaecd0f115f52e7c3f9a3e798617d6fbf5f7d"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82741",
"datePublished": "2026-09-01T03:33:03.442Z",
"dateReserved": "2026-08-31T00:59:10.002Z",
"dateUpdated": "2026-09-01T15:13:10.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82740 (GCVE-0-2026-82740)
Vulnerability from nvd – Published: 2026-09-01 03:29 – Updated: 2026-09-01 12:42
VLAI
EPSS
VEX
Title
Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs
Summary
Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested {:array, {:array, type}} attribute, letting invalid input pass validation.
Ash.Type.apply_constraints/3 (lib/ash/type/type.ex) handled the {:array, {:array, type}} case by mapping only the inner {:array, type} constraints over each element, so constraints declared on the outer array (such as min_length, max_length, and nil_items?) were never applied. An attacker could submit an outer list that violates those constraints (too many elements, or nil entries where disallowed) and have it accepted and persisted. The fix enforces the outer array constraints and adds explicit handling for nil and non-list inputs.
This issue affects ash: from 2.16.1 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:42 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82740.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82740 | related |
| https://github.com/ash-project/ash/commit/c85ccff… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.16.1 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
7b50a401d85018371659e51c34c89d7e1d0c2ac9 , < c85ccff7dc6e3b0b3e40ad788b0056b3b6bee5ce
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82740",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:42:32.300749Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:42:58.541Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-v29m-p28g-w5fc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/type.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type\u0027:apply_constraints/3"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "2.16.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/type.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type\u0027:apply_constraints/3"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "c85ccff7dc6e3b0b3e40ad788b0056b3b6bee5ce",
"status": "affected",
"version": "7b50a401d85018371659e51c34c89d7e1d0c2ac9",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "2.16.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested \u003ccode\u003e{:array, {:array, type}}\u003c/code\u003e attribute, letting invalid input pass validation.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Type.apply_constraints/3\u003c/code\u003e (\u003ccode\u003elib/ash/type/type.ex\u003c/code\u003e) handled the \u003ccode\u003e{:array, {:array, type}}\u003c/code\u003e case by mapping only the inner \u003ccode\u003e{:array, type}\u003c/code\u003e constraints over each element, so constraints declared on the outer array (such as \u003ccode\u003emin_length\u003c/code\u003e, \u003ccode\u003emax_length\u003c/code\u003e, and \u003ccode\u003enil_items?\u003c/code\u003e) were never applied. An attacker could submit an outer list that violates those constraints (too many elements, or \u003ccode\u003enil\u003c/code\u003e entries where disallowed) and have it accepted and persisted. The fix enforces the outer array constraints and adds explicit handling for \u003ccode\u003enil\u003c/code\u003e and non-list inputs.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.16.1 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested `{:array, {:array, type}}` attribute, letting invalid input pass validation.\n\n`Ash.Type.apply_constraints/3` (`lib/ash/type/type.ex`) handled the `{:array, {:array, type}}` case by mapping only the inner `{:array, type}` constraints over each element, so constraints declared on the outer array (such as `min_length`, `max_length`, and `nil_items?`) were never applied. An attacker could submit an outer list that violates those constraints (too many elements, or `nil` entries where disallowed) and have it accepted and persisted. The fix enforces the outer array constraints and adds explicit handling for `nil` and non-list inputs.\n\nThis issue affects ash: from 2.16.1 before 3.32.2."
}
],
"value": "Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested {:array, {:array, type}} attribute, letting invalid input pass validation.\n\nAsh.Type.apply_constraints/3 (lib/ash/type/type.ex) handled the {:array, {:array, type}} case by mapping only the inner {:array, type} constraints over each element, so constraints declared on the outer array (such as min_length, max_length, and nil_items?) were never applied. An attacker could submit an outer list that violates those constraints (too many elements, or nil entries where disallowed) and have it accepted and persisted. The fix enforces the outer array constraints and adds explicit handling for nil and non-list inputs.\n\nThis issue affects ash: from 2.16.1 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:29:11.804Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-v29m-p28g-w5fc"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82740.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82740"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/c85ccff7dc6e3b0b3e40ad788b0056b3b6bee5ce"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82740",
"datePublished": "2026-09-01T03:29:11.804Z",
"dateReserved": "2026-08-31T00:59:10.002Z",
"dateUpdated": "2026-09-01T12:42:58.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82739 (GCVE-0-2026-82739)
Vulnerability from nvd – Published: 2026-09-01 03:27 – Updated: 2026-09-01 12:44
VLAI
EPSS
VEX
Title
Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.
Ash.Resource.Validation.Confirm's atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field's current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.
This issue affects ash: from 2.17.20 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:43 UTC
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82739.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82739 | related |
| https://github.com/ash-project/ash/commit/7dfe5f0… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.17.20 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
fadecf3ee95640bd3bc7298df4799e0375537fd2 , < 7dfe5f0b1ba4267580ded947dc861351d4dc8e2b
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82739",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:43:57.417588Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:44:21.482Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-66cg-vj5m-8w7v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Resource.Validation.Confirm\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/resource/validation/confirm.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027:atomic/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "2.17.20",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Resource.Validation.Confirm\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/resource/validation/confirm.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027:atomic/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "7dfe5f0b1ba4267580ded947dc861351d4dc8e2b",
"status": "affected",
"version": "fadecf3ee95640bd3bc7298df4799e0375537fd2",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "2.17.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Resource.Validation.Confirm\u003c/code\u003e\u0027s atomic implementation (\u003ccode\u003eatomic/2\u003c/code\u003e in \u003ccode\u003elib/ash/resource/validation/confirm.ex\u003c/code\u003e) built the mismatch error with its \u003ccode\u003evalue\u003c/code\u003e set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, \u003ccode\u003evalue\u003c/code\u003e resolves through \u003ccode\u003eatomic_ref/2\u003c/code\u003e to the field\u0027s current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.17.20 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.\n\n`Ash.Resource.Validation.Confirm`\u0027s atomic implementation (`atomic/2` in `lib/ash/resource/validation/confirm.ex`) built the mismatch error with its `value` set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, `value` resolves through `atomic_ref/2` to the field\u0027s current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.\n\nThis issue affects ash: from 2.17.20 before 3.32.2."
}
],
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.\n\nAsh.Resource.Validation.Confirm\u0027s atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field\u0027s current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.\n\nThis issue affects ash: from 2.17.20 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-54",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-54 Query System for Information"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:27:58.165Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-66cg-vj5m-8w7v"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82739.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82739"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/7dfe5f0b1ba4267580ded947dc861351d4dc8e2b"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Resource.Validation.Confirm leaks a confirmed field\u0027s stored value in the atomic mismatch error"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82739",
"datePublished": "2026-09-01T03:27:58.165Z",
"dateReserved": "2026-08-31T00:59:10.002Z",
"dateUpdated": "2026-09-01T12:44:21.482Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82738 (GCVE-0-2026-82738)
Vulnerability from nvd – Published: 2026-09-01 03:26 – Updated: 2026-09-01 12:47
VLAI
EPSS
VEX
Title
Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service
Summary
Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute.
Ash.Type.UUIDv7.cast_input/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a 16-byte binary. On read, cast_stored/2 (lib/ash/type/uuid_v7.ex) routes the stored binary back through cast_input/2, which since an input-validation tightening in v3.6.3 matches only version-7 (and optionally version-4) 16-byte binaries and otherwise expects a 36-character string. A stored non-v7 16-byte binary matches neither clause and returns :error, so every later read of that record fails. An attacker able to set such an attribute poisons the row permanently. The fix decodes any 16-byte stored binary directly in cast_stored/2.
This issue affects ash: from 3.6.3 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:46 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82738.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82738 | related |
| https://github.com/ash-project/ash/commit/c453cdc… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.6.3 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
751d8a4d11564efbe358c90c8347f3a00eb60782 , < c453cdc0b8570e86ffef0d10e136247f52b3ea76
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82738",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:46:45.556475Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:47:34.853Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-7xfw-9jwm-9c4c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.UUIDv7\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/uuid_v7.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.UUIDv7\u0027:cast_input/2"
},
{
"name": "\u0027Elixir.Ash.Type.UUIDv7\u0027:cast_stored/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "3.6.3",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.UUIDv7\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/uuid_v7.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.UUIDv7\u0027:cast_input/2"
},
{
"name": "\u0027Elixir.Ash.Type.UUIDv7\u0027:cast_stored/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "c453cdc0b8570e86ffef0d10e136247f52b3ea76",
"status": "affected",
"version": "751d8a4d11564efbe358c90c8347f3a00eb60782",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "3.6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an \u003ccode\u003eAsh.Type.UUIDv7\u003c/code\u003e attribute.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Type.UUIDv7.cast_input/2\u003c/code\u003e accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a 16-byte binary. On read, \u003ccode\u003ecast_stored/2\u003c/code\u003e (\u003ccode\u003elib/ash/type/uuid_v7.ex\u003c/code\u003e) routes the stored binary back through \u003ccode\u003ecast_input/2\u003c/code\u003e, which since an input-validation tightening in v3.6.3 matches only version-7 (and optionally version-4) 16-byte binaries and otherwise expects a 36-character string. A stored non-v7 16-byte binary matches neither clause and returns \u003ccode\u003e:error\u003c/code\u003e, so every later read of that record fails. An attacker able to set such an attribute poisons the row permanently. The fix decodes any 16-byte stored binary directly in \u003ccode\u003ecast_stored/2\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.6.3 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an `Ash.Type.UUIDv7` attribute.\n\n`Ash.Type.UUIDv7.cast_input/2` accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a 16-byte binary. On read, `cast_stored/2` (`lib/ash/type/uuid_v7.ex`) routes the stored binary back through `cast_input/2`, which since an input-validation tightening in v3.6.3 matches only version-7 (and optionally version-4) 16-byte binaries and otherwise expects a 36-character string. A stored non-v7 16-byte binary matches neither clause and returns `:error`, so every later read of that record fails. An attacker able to set such an attribute poisons the row permanently. The fix decodes any 16-byte stored binary directly in `cast_stored/2`.\n\nThis issue affects ash: from 3.6.3 before 3.32.2."
}
],
"value": "Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute.\n\nAsh.Type.UUIDv7.cast_input/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a 16-byte binary. On read, cast_stored/2 (lib/ash/type/uuid_v7.ex) routes the stored binary back through cast_input/2, which since an input-validation tightening in v3.6.3 matches only version-7 (and optionally version-4) 16-byte binaries and otherwise expects a 36-character string. A stored non-v7 16-byte binary matches neither clause and returns :error, so every later read of that record fails. An attacker able to set such an attribute poisons the row permanently. The fix decodes any 16-byte stored binary directly in cast_stored/2.\n\nThis issue affects ash: from 3.6.3 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:26:23.035Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-7xfw-9jwm-9c4c"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82738.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82738"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/c453cdc0b8570e86ffef0d10e136247f52b3ea76"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82738",
"datePublished": "2026-09-01T03:26:23.035Z",
"dateReserved": "2026-08-31T00:59:10.002Z",
"dateUpdated": "2026-09-01T12:47:34.853Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82737 (GCVE-0-2026-82737)
Vulnerability from nvd – Published: 2026-09-01 03:24 – Updated: 2026-09-01 12:56
VLAI
EPSS
VEX
Title
Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads
Summary
Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.
Ash.Vector.new/1 (lib/ash/vector.ex) encodes a vector as <<dim::unsigned-16, 0::unsigned-16>> followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. from_binary/1 later reads binary-size(dim)-unit(32) from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.
This issue affects ash: from 2.14.13 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:55 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82737.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82737 | related |
| https://github.com/ash-project/ash/commit/cef5eb7… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.14.13 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
e2855843ca4a9141dcd7f40f47227e13b43f0e00 , < cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82737",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:55:44.794250Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:56:53.991Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-68q3-w4w3-2gfv"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Vector\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/vector.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Vector\u0027:new/1"
},
{
"name": "\u0027Elixir.Ash.Vector\u0027:from_binary/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "2.14.13",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Vector\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/vector.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Vector\u0027:new/1"
},
{
"name": "\u0027Elixir.Ash.Vector\u0027:from_binary/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe",
"status": "affected",
"version": "e2855843ca4a9141dcd7f40f47227e13b43f0e00",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "2.14.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInteger Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Vector.new/1\u003c/code\u003e (\u003ccode\u003elib/ash/vector.ex\u003c/code\u003e) encodes a vector as \u003ccode\u003e\u0026lt;\u0026lt;dim::unsigned-16, 0::unsigned-16\u0026gt;\u0026gt;\u003c/code\u003e followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. \u003ccode\u003efrom_binary/1\u003c/code\u003e later reads \u003ccode\u003ebinary-size(dim)-unit(32)\u003c/code\u003e from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.14.13 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.\n\n`Ash.Vector.new/1` (`lib/ash/vector.ex`) encodes a vector as `\u003c\u003cdim::unsigned-16, 0::unsigned-16\u003e\u003e` followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. `from_binary/1` later reads `binary-size(dim)-unit(32)` from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.\n\nThis issue affects ash: from 2.14.13 before 3.32.2."
}
],
"value": "Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.\n\nAsh.Vector.new/1 (lib/ash/vector.ex) encodes a vector as \u003c\u003cdim::unsigned-16, 0::unsigned-16\u003e\u003e followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. from_binary/1 later reads binary-size(dim)-unit(32) from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.\n\nThis issue affects ash: from 2.14.13 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-92",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-92 Forced Integer Overflow"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:24:14.969Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-68q3-w4w3-2gfv"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82737.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82737"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82737",
"datePublished": "2026-09-01T03:24:14.969Z",
"dateReserved": "2026-08-31T00:59:10.002Z",
"dateUpdated": "2026-09-01T12:56:53.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82736 (GCVE-0-2026-82736)
Vulnerability from nvd – Published: 2026-09-01 03:21 – Updated: 2026-09-01 13:06
VLAI
EPSS
VEX
Title
Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass
Summary
Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints.
Ash.Type.CiString.apply_constraints/2 (lib/ash/type/ci_string.ex) validated the max_length, min_length, and match constraints against the value as submitted, while the type case-folds the string (per its casing) for storage and comparison. Because validation ran before folding, an attacker can submit a value whose folded form breaks a constraint but whose original form passes: for example, against a match pattern requiring uppercase, an uppercase value that is stored lowercased persists a value the pattern rejects. The fix case-folds the value at the start of apply_constraints/2, so the constraints are checked against the form that is actually stored.
This issue affects ash: from 1.29.0-rc0 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:58 UTC
CWE
- CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82736.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82736 | related |
| https://github.com/ash-project/ash/commit/d8320b0… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
1.29.0-rc0 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
f6f5d194bfc7802bd32e48bf2eabd2d97a0109a4 , < d8320b0127c8ef453679d70e5dd23a9506951d21
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82736",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:58:09.993835Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T13:06:35.213Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-gg9w-7593-hxg9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.CiString\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/ci_string.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.CiString\u0027:apply_constraints/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "1.29.0-rc0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.CiString\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/ci_string.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.CiString\u0027:apply_constraints/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "d8320b0127c8ef453679d70e5dd23a9506951d21",
"status": "affected",
"version": "f6f5d194bfc7802bd32e48bf2eabd2d97a0109a4",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "1.29.0-rc0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Type.CiString.apply_constraints/2\u003c/code\u003e (\u003ccode\u003elib/ash/type/ci_string.ex\u003c/code\u003e) validated the \u003ccode\u003emax_length\u003c/code\u003e, \u003ccode\u003emin_length\u003c/code\u003e, and \u003ccode\u003ematch\u003c/code\u003e constraints against the value as submitted, while the type case-folds the string (per its \u003ccode\u003ecasing\u003c/code\u003e) for storage and comparison. Because validation ran before folding, an attacker can submit a value whose folded form breaks a constraint but whose original form passes: for example, against a match pattern requiring uppercase, an uppercase value that is stored lowercased persists a value the pattern rejects. The fix case-folds the value at the start of \u003ccode\u003eapply_constraints/2\u003c/code\u003e, so the constraints are checked against the form that is actually stored.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 1.29.0-rc0 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints.\n\n`Ash.Type.CiString.apply_constraints/2` (`lib/ash/type/ci_string.ex`) validated the `max_length`, `min_length`, and `match` constraints against the value as submitted, while the type case-folds the string (per its `casing`) for storage and comparison. Because validation ran before folding, an attacker can submit a value whose folded form breaks a constraint but whose original form passes: for example, against a match pattern requiring uppercase, an uppercase value that is stored lowercased persists a value the pattern rejects. The fix case-folds the value at the start of `apply_constraints/2`, so the constraints are checked against the form that is actually stored.\n\nThis issue affects ash: from 1.29.0-rc0 before 3.32.2."
}
],
"value": "Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints.\n\nAsh.Type.CiString.apply_constraints/2 (lib/ash/type/ci_string.ex) validated the max_length, min_length, and match constraints against the value as submitted, while the type case-folds the string (per its casing) for storage and comparison. Because validation ran before folding, an attacker can submit a value whose folded form breaks a constraint but whose original form passes: for example, against a match pattern requiring uppercase, an uppercase value that is stored lowercased persists a value the pattern rejects. The fix case-folds the value at the start of apply_constraints/2, so the constraints are checked against the form that is actually stored.\n\nThis issue affects ash: from 1.29.0-rc0 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-267",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-267 Leverage Alternate Encoding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-180",
"description": "CWE-180 Incorrect Behavior Order: Validate Before Canonicalize",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:21:47.332Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-gg9w-7593-hxg9"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82736.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82736"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/d8320b0127c8ef453679d70e5dd23a9506951d21"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82736",
"datePublished": "2026-09-01T03:21:47.332Z",
"dateReserved": "2026-08-31T00:59:10.001Z",
"dateUpdated": "2026-09-01T13:06:35.213Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82735 (GCVE-0-2026-82735)
Vulnerability from nvd – Published: 2026-09-01 03:19 – Updated: 2026-09-01 13:11
VLAI
EPSS
VEX
Title
Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service
Summary
Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected.
Ash.Type.String.apply_constraints/2 (lib/ash/type/string.ex) evaluated the :match regex regardless of the min_length and max_length constraints on the same attribute. Because the length check did not gate the regex, an over-length value that the length constraint rejects still had the pattern applied to it, so the length limit that would otherwise bound the work never constrained the regex input. Against a backtracking pattern this yields catastrophic regex evaluation on attacker-sized input, and even a linear pattern runs on arbitrarily large input, consuming CPU per request. The fix skips the :match regex whenever a length constraint is violated, making the two checks order-independent.
This issue affects ash: from 0.10.0 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 13:10 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82735.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82735 | related |
| https://github.com/ash-project/ash/commit/1492841… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
0.10.0 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
05848d5f4affe60fddd812222a18ada080c0813b , < 14928412a1a94a69c47df8e98920d3a2b09cdec4
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82735",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T13:10:30.868246Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T13:11:14.176Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-mq7g-pffw-m8xh"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.String\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/string.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.String\u0027:apply_constraints/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "0.10.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.String\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/string.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.String\u0027:apply_constraints/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "14928412a1a94a69c47df8e98920d3a2b09cdec4",
"status": "affected",
"version": "05848d5f4affe60fddd812222a18ada080c0813b",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "0.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Type.String.apply_constraints/2\u003c/code\u003e (\u003ccode\u003elib/ash/type/string.ex\u003c/code\u003e) evaluated the \u003ccode\u003e:match\u003c/code\u003e regex regardless of the \u003ccode\u003emin_length\u003c/code\u003e and \u003ccode\u003emax_length\u003c/code\u003e constraints on the same attribute. Because the length check did not gate the regex, an over-length value that the length constraint rejects still had the pattern applied to it, so the length limit that would otherwise bound the work never constrained the regex input. Against a backtracking pattern this yields catastrophic regex evaluation on attacker-sized input, and even a linear pattern runs on arbitrarily large input, consuming CPU per request. The fix skips the \u003ccode\u003e:match\u003c/code\u003e regex whenever a length constraint is violated, making the two checks order-independent.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 0.10.0 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected.\n\n`Ash.Type.String.apply_constraints/2` (`lib/ash/type/string.ex`) evaluated the `:match` regex regardless of the `min_length` and `max_length` constraints on the same attribute. Because the length check did not gate the regex, an over-length value that the length constraint rejects still had the pattern applied to it, so the length limit that would otherwise bound the work never constrained the regex input. Against a backtracking pattern this yields catastrophic regex evaluation on attacker-sized input, and even a linear pattern runs on arbitrarily large input, consuming CPU per request. The fix skips the `:match` regex whenever a length constraint is violated, making the two checks order-independent.\n\nThis issue affects ash: from 0.10.0 before 3.32.2."
}
],
"value": "Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected.\n\nAsh.Type.String.apply_constraints/2 (lib/ash/type/string.ex) evaluated the :match regex regardless of the min_length and max_length constraints on the same attribute. Because the length check did not gate the regex, an over-length value that the length constraint rejects still had the pattern applied to it, so the length limit that would otherwise bound the work never constrained the regex input. Against a backtracking pattern this yields catastrophic regex evaluation on attacker-sized input, and even a linear pattern runs on arbitrarily large input, consuming CPU per request. The fix skips the :match regex whenever a length constraint is violated, making the two checks order-independent.\n\nThis issue affects ash: from 0.10.0 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-492",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-492 Regular Expression Exponential Blowup"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:19:36.579Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-mq7g-pffw-m8xh"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82735.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82735"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/14928412a1a94a69c47df8e98920d3a2b09cdec4"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82735",
"datePublished": "2026-09-01T03:19:36.579Z",
"dateReserved": "2026-08-31T00:59:10.001Z",
"dateUpdated": "2026-09-01T13:11:14.176Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82734 (GCVE-0-2026-82734)
Vulnerability from nvd – Published: 2026-09-01 03:17 – Updated: 2026-09-01 15:15
VLAI
EPSS
VEX
Title
Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal
Summary
Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value.
Ash.Type.Decimal cast input through Ecto's decimal cast in cast_input/2 and cast_stored/2 (lib/ash/type/decimal.ex) without checking that the resulting value is finite. Elixir's Decimal represents Infinity and NaN as valid structs, so a value such as "Infinity" or "NaN" passed casting and was persisted. Because NaN compares as false against every bound, min and max constraints do not reject it, and the stored special value later raises when used in Decimal arithmetic or is refused by the data layer, failing subsequent requests. The fix rejects any non-finite Decimal during casting.
This issue affects ash: from 1.28.0 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:14 UTC
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82734.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82734 | related |
| https://github.com/ash-project/ash/commit/818087b… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
1.28.0 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
db6bdfcf1518c70d67975efb140cdeb2cb6a76e7 , < 818087b1b3364f2af6f5460d6b01262ad0f69204
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82734",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:14:56.006491Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:15:19.108Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-mvvh-q33h-q62v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.Decimal\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/decimal.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.Decimal\u0027:cast_input/2"
},
{
"name": "\u0027Elixir.Ash.Type.Decimal\u0027:cast_stored/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "1.28.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.Decimal\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/decimal.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.Decimal\u0027:cast_input/2"
},
{
"name": "\u0027Elixir.Ash.Type.Decimal\u0027:cast_stored/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "818087b1b3364f2af6f5460d6b01262ad0f69204",
"status": "affected",
"version": "db6bdfcf1518c70d67975efb140cdeb2cb6a76e7",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "1.28.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Type.Decimal\u003c/code\u003e cast input through Ecto\u0027s decimal cast in \u003ccode\u003ecast_input/2\u003c/code\u003e and \u003ccode\u003ecast_stored/2\u003c/code\u003e (\u003ccode\u003elib/ash/type/decimal.ex\u003c/code\u003e) without checking that the resulting value is finite. Elixir\u0027s \u003ccode\u003eDecimal\u003c/code\u003e represents \u003ccode\u003eInfinity\u003c/code\u003e and \u003ccode\u003eNaN\u003c/code\u003e as valid structs, so a value such as \u003ccode\u003e\"Infinity\"\u003c/code\u003e or \u003ccode\u003e\"NaN\"\u003c/code\u003e passed casting and was persisted. Because \u003ccode\u003eNaN\u003c/code\u003e compares as false against every bound, \u003ccode\u003emin\u003c/code\u003e and \u003ccode\u003emax\u003c/code\u003e constraints do not reject it, and the stored special value later raises when used in \u003ccode\u003eDecimal\u003c/code\u003e arithmetic or is refused by the data layer, failing subsequent requests. The fix rejects any non-finite \u003ccode\u003eDecimal\u003c/code\u003e during casting.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 1.28.0 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value.\n\n`Ash.Type.Decimal` cast input through Ecto\u0027s decimal cast in `cast_input/2` and `cast_stored/2` (`lib/ash/type/decimal.ex`) without checking that the resulting value is finite. Elixir\u0027s `Decimal` represents `Infinity` and `NaN` as valid structs, so a value such as `\"Infinity\"` or `\"NaN\"` passed casting and was persisted. Because `NaN` compares as false against every bound, `min` and `max` constraints do not reject it, and the stored special value later raises when used in `Decimal` arithmetic or is refused by the data layer, failing subsequent requests. The fix rejects any non-finite `Decimal` during casting.\n\nThis issue affects ash: from 1.28.0 before 3.32.2."
}
],
"value": "Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value.\n\nAsh.Type.Decimal cast input through Ecto\u0027s decimal cast in cast_input/2 and cast_stored/2 (lib/ash/type/decimal.ex) without checking that the resulting value is finite. Elixir\u0027s Decimal represents Infinity and NaN as valid structs, so a value such as \"Infinity\" or \"NaN\" passed casting and was persisted. Because NaN compares as false against every bound, min and max constraints do not reject it, and the stored special value later raises when used in Decimal arithmetic or is refused by the data layer, failing subsequent requests. The fix rejects any non-finite Decimal during casting.\n\nThis issue affects ash: from 1.28.0 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:17:15.389Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-mvvh-q33h-q62v"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82734.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82734"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/818087b1b3364f2af6f5460d6b01262ad0f69204"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82734",
"datePublished": "2026-09-01T03:17:15.389Z",
"dateReserved": "2026-08-31T00:59:10.001Z",
"dateUpdated": "2026-09-01T15:15:19.108Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82747 (GCVE-0-2026-82747)
Vulnerability from cvelistv5 – Published: 2026-09-01 04:14 – Updated: 2026-09-01 12:36
VLAI
EPSS
VEX
Title
Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
Summary
Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.
When a resource has an access_type :runtime read policy (a check evaluated per record rather than compiled to a filter), Ash.Policy.Authorizer decides each record in check_result/1 (lib/ash/policy/authorizer/authorizer.ex) by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record ({[record | data], authorizer, any_forbidden?}) and returned it as authorized. As a result, records the runtime read policy denies are returned to any actor. The fix forbids a record whose scenarios are all impossible.
This issue affects ash: from 3.4.44 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:36 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82747.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82747 | related |
| https://github.com/ash-project/ash/commit/6eddb8a… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.4.44 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
f4a8ff53fd3b974468d73685cd3fc842ef893de3 , < 6eddb8ab26e45023faf0c79ebd152bb40aefda02
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82747",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:36:21.694323Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:36:50.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-4259-gvr2-4xhq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Policy.Authorizer\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/policy/authorizer/authorizer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Policy.Authorizer\u0027:check_result/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "3.4.44",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Policy.Authorizer\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/policy/authorizer/authorizer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Policy.Authorizer\u0027:check_result/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "6eddb8ab26e45023faf0c79ebd152bb40aefda02",
"status": "affected",
"version": "f4a8ff53fd3b974468d73685cd3fc842ef893de3",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "3.4.44",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.\u003c/p\u003e\n\u003cp\u003eWhen a resource has an \u003ccode\u003eaccess_type :runtime\u003c/code\u003e read policy (a check evaluated per record rather than compiled to a filter), \u003ccode\u003eAsh.Policy.Authorizer\u003c/code\u003e decides each record in \u003ccode\u003echeck_result/1\u003c/code\u003e (\u003ccode\u003elib/ash/policy/authorizer/authorizer.ex\u003c/code\u003e) by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record (\u003ccode\u003e{[record | data], authorizer, any_forbidden?}\u003c/code\u003e) and returned it as authorized. As a result, records the runtime read policy denies are returned to any actor. The fix forbids a record whose scenarios are all impossible.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.4.44 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.\n\nWhen a resource has an `access_type :runtime` read policy (a check evaluated per record rather than compiled to a filter), `Ash.Policy.Authorizer` decides each record in `check_result/1` (`lib/ash/policy/authorizer/authorizer.ex`) by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record (`{[record | data], authorizer, any_forbidden?}`) and returned it as authorized. As a result, records the runtime read policy denies are returned to any actor. The fix forbids a record whose scenarios are all impossible.\n\nThis issue affects ash: from 3.4.44 before 3.32.2."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.\n\nWhen a resource has an access_type :runtime read policy (a check evaluated per record rather than compiled to a filter), Ash.Policy.Authorizer decides each record in check_result/1 (lib/ash/policy/authorizer/authorizer.ex) by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record ({[record | data], authorizer, any_forbidden?}) and returned it as authorized. As a result, records the runtime read policy denies are returned to any actor. The fix forbids a record whose scenarios are all impossible.\n\nThis issue affects ash: from 3.4.44 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T04:14:57.840Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-4259-gvr2-4xhq"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82747.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82747"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/6eddb8ab26e45023faf0c79ebd152bb40aefda02"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82747",
"datePublished": "2026-09-01T04:14:57.840Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T12:36:50.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82749 (GCVE-0-2026-82749)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:54 – Updated: 2026-09-01 12:38
VLAI
EPSS
VEX
Title
Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records
Summary
Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match unintended records when the referenced parent field cannot be resolved.
Loading a relationship whose filter references parent(...) resolves that expression against the parent record. resolve_parent_in_filter/3 (lib/ash/actions/read/relationships.ex) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to nil rather than failing. A scoping predicate such as org_id == parent(org_id) then becomes an IS NULL match, and a guard like is_nil(parent(org_id)) or org_id == parent(org_id) activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a parent(...) reference cannot be resolved, instead of defaulting to nil.
This issue affects ash: from 3.13.2 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:37 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82749.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82749 | related |
| https://github.com/ash-project/ash/commit/e52dad2… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.13.2 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
0ddff26e6e6bc6d182e1af2f98b431575e5b4179 , < e52dad2c39a35f6f043f7324d26e4f4e2551dfd2
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82749",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:37:51.333023Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:38:27.534Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-j8fx-ff37-4j9c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/read/relationships.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:resolve_parent_in_filter/3"
},
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:do_per_record_no_attributes_load/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "3.13.2",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/read/relationships.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:resolve_parent_in_filter/3"
},
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:do_per_record_no_attributes_load/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "e52dad2c39a35f6f043f7324d26e4f4e2551dfd2",
"status": "affected",
"version": "0ddff26e6e6bc6d182e1af2f98b431575e5b4179",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "3.13.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash widens a relationship\u0027s \u003ccode\u003eparent(...)\u003c/code\u003e scoping filter to match unintended records when the referenced parent field cannot be resolved.\u003c/p\u003e\n\u003cp\u003eLoading a relationship whose filter references \u003ccode\u003eparent(...)\u003c/code\u003e resolves that expression against the parent record. \u003ccode\u003eresolve_parent_in_filter/3\u003c/code\u003e (\u003ccode\u003elib/ash/actions/read/relationships.ex\u003c/code\u003e) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to \u003ccode\u003enil\u003c/code\u003e rather than failing. A scoping predicate such as \u003ccode\u003eorg_id == parent(org_id)\u003c/code\u003e then becomes an \u003ccode\u003eIS NULL\u003c/code\u003e match, and a guard like \u003ccode\u003eis_nil(parent(org_id)) or org_id == parent(org_id)\u003c/code\u003e activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a \u003ccode\u003eparent(...)\u003c/code\u003e reference cannot be resolved, instead of defaulting to nil.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.13.2 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash widens a relationship\u0027s `parent(...)` scoping filter to match unintended records when the referenced parent field cannot be resolved.\n\nLoading a relationship whose filter references `parent(...)` resolves that expression against the parent record. `resolve_parent_in_filter/3` (`lib/ash/actions/read/relationships.ex`) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to `nil` rather than failing. A scoping predicate such as `org_id == parent(org_id)` then becomes an `IS NULL` match, and a guard like `is_nil(parent(org_id)) or org_id == parent(org_id)` activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a `parent(...)` reference cannot be resolved, instead of defaulting to nil.\n\nThis issue affects ash: from 3.13.2 before 3.32.2."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash widens a relationship\u0027s parent(...) scoping filter to match unintended records when the referenced parent field cannot be resolved.\n\nLoading a relationship whose filter references parent(...) resolves that expression against the parent record. resolve_parent_in_filter/3 (lib/ash/actions/read/relationships.ex) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to nil rather than failing. A scoping predicate such as org_id == parent(org_id) then becomes an IS NULL match, and a guard like is_nil(parent(org_id)) or org_id == parent(org_id) activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a parent(...) reference cannot be resolved, instead of defaulting to nil.\n\nThis issue affects ash: from 3.13.2 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:54:12.716Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-j8fx-ff37-4j9c"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82749.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82749"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/e52dad2c39a35f6f043f7324d26e4f4e2551dfd2"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82749",
"datePublished": "2026-09-01T03:54:12.716Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T12:38:27.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82748 (GCVE-0-2026-82748)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:52 – Updated: 2026-09-01 15:17
VLAI
EPSS
VEX
Title
Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another
Summary
Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against.
Ash.Actions.Aggregate groups aggregates by their {authorize?, read_action} and authorizes each group under that read action, but when building the data query it selected the action as opts[:action] || read_action || <primary read> (lib/ash/actions/aggregate.ex). When a caller passed an :action option, the aggregate query ran under that action while authorization had been computed for the group's own read_action. If the run action's read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action's policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same read_action it is authorized against.
This issue affects ash: from 3.5.13 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:17 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82748.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82748 | related |
| https://github.com/ash-project/ash/commit/2d9b78b… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.5.13 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
d2e99980380cad610dbab3c4167e85323244bc71 , < 2d9b78b87d2dc72885a8aa1d660b478d42f749f7
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82748",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:17:28.654451Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:17:47.434Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-g5hp-mghm-3mgp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Aggregate\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/aggregate.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Aggregate\u0027:run/4"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "3.5.13",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Aggregate\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/aggregate.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Aggregate\u0027:run/4"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2d9b78b87d2dc72885a8aa1d660b478d42f749f7",
"status": "affected",
"version": "d2e99980380cad610dbab3c4167e85323244bc71",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "3.5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Actions.Aggregate\u003c/code\u003e groups aggregates by their \u003ccode\u003e{authorize?, read_action}\u003c/code\u003e and authorizes each group under that read action, but when building the data query it selected the action as \u003ccode\u003eopts[:action] || read_action || \u0026lt;primary read\u0026gt;\u003c/code\u003e (\u003ccode\u003elib/ash/actions/aggregate.ex\u003c/code\u003e). When a caller passed an \u003ccode\u003e:action\u003c/code\u003e option, the aggregate query ran under that action while authorization had been computed for the group\u0027s own \u003ccode\u003eread_action\u003c/code\u003e. If the run action\u0027s read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action\u0027s policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same \u003ccode\u003eread_action\u003c/code\u003e it is authorized against.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.5.13 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against.\n\n`Ash.Actions.Aggregate` groups aggregates by their `{authorize?, read_action}` and authorizes each group under that read action, but when building the data query it selected the action as `opts[:action] || read_action || \u003cprimary read\u003e` (`lib/ash/actions/aggregate.ex`). When a caller passed an `:action` option, the aggregate query ran under that action while authorization had been computed for the group\u0027s own `read_action`. If the run action\u0027s read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action\u0027s policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same `read_action` it is authorized against.\n\nThis issue affects ash: from 3.5.13 before 3.32.2."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against.\n\nAsh.Actions.Aggregate groups aggregates by their {authorize?, read_action} and authorizes each group under that read action, but when building the data query it selected the action as opts[:action] || read_action || \u003cprimary read\u003e (lib/ash/actions/aggregate.ex). When a caller passed an :action option, the aggregate query ran under that action while authorization had been computed for the group\u0027s own read_action. If the run action\u0027s read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action\u0027s policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same read_action it is authorized against.\n\nThis issue affects ash: from 3.5.13 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:52:01.686Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-g5hp-mghm-3mgp"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82748.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82748"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/2d9b78b87d2dc72885a8aa1d660b478d42f749f7"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82748",
"datePublished": "2026-09-01T03:52:01.686Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T15:17:47.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82746 (GCVE-0-2026-82746)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:47 – Updated: 2026-09-01 15:17
VLAI
EPSS
VEX
Title
Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records
Summary
Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.update_many/4.
Ash.update_many/4 runs as a single atomic statement (a data-layer update_many, for example a SQL MERGE) whenever an atomic strategy is used and the data layer supports it. Ash.Actions.Update.UpdateMany (lib/ash/actions/update/update_many.ex) took that path even under authorize?: true without applying the resource's policies, so the statement updated every row matched by primary key regardless of the policy filter that authorization would impose. An actor could therefore update records the policies forbid, such as rows belonging to another actor or tenant. The fix restricts the atomic path to data layers supporting changeset filters when authorizing, authorizes each changeset, and merges the resulting policy filter into each changeset so the statement only touches authorized rows.
This issue affects ash: from 3.29.0 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:16 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82746.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82746 | related |
| https://github.com/ash-project/ash/commit/ed4e656… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.29.0 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
45e6b4ec7b2dc076afe614aa7aef7e1f15b5e335 , < ed4e656822ffe83f8e960d5de0b573c0d1ae7f29
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82746",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:16:54.224249Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:17:12.056Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-j7c9-3fw3-jc64"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Update.UpdateMany\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/update/update_many.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Update.UpdateMany\u0027:run/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "3.29.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Update.UpdateMany\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/update/update_many.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Update.UpdateMany\u0027:run/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "ed4e656822ffe83f8e960d5de0b573c0d1ae7f29",
"status": "affected",
"version": "45e6b4ec7b2dc076afe614aa7aef7e1f15b5e335",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "3.29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of \u003ccode\u003eAsh.update_many/4\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.update_many/4\u003c/code\u003e runs as a single atomic statement (a data-layer \u003ccode\u003eupdate_many\u003c/code\u003e, for example a SQL MERGE) whenever an atomic strategy is used and the data layer supports it. \u003ccode\u003eAsh.Actions.Update.UpdateMany\u003c/code\u003e (\u003ccode\u003elib/ash/actions/update/update_many.ex\u003c/code\u003e) took that path even under \u003ccode\u003eauthorize?: true\u003c/code\u003e without applying the resource\u0027s policies, so the statement updated every row matched by primary key regardless of the policy filter that authorization would impose. An actor could therefore update records the policies forbid, such as rows belonging to another actor or tenant. The fix restricts the atomic path to data layers supporting changeset filters when authorizing, authorizes each changeset, and merges the resulting policy filter into each changeset so the statement only touches authorized rows.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.29.0 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of `Ash.update_many/4`.\n\n`Ash.update_many/4` runs as a single atomic statement (a data-layer `update_many`, for example a SQL MERGE) whenever an atomic strategy is used and the data layer supports it. `Ash.Actions.Update.UpdateMany` (`lib/ash/actions/update/update_many.ex`) took that path even under `authorize?: true` without applying the resource\u0027s policies, so the statement updated every row matched by primary key regardless of the policy filter that authorization would impose. An actor could therefore update records the policies forbid, such as rows belonging to another actor or tenant. The fix restricts the atomic path to data layers supporting changeset filters when authorizing, authorizes each changeset, and merges the resulting policy filter into each changeset so the statement only touches authorized rows.\n\nThis issue affects ash: from 3.29.0 before 3.32.2."
}
],
"value": "Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.update_many/4.\n\nAsh.update_many/4 runs as a single atomic statement (a data-layer update_many, for example a SQL MERGE) whenever an atomic strategy is used and the data layer supports it. Ash.Actions.Update.UpdateMany (lib/ash/actions/update/update_many.ex) took that path even under authorize?: true without applying the resource\u0027s policies, so the statement updated every row matched by primary key regardless of the policy filter that authorization would impose. An actor could therefore update records the policies forbid, such as rows belonging to another actor or tenant. The fix restricts the atomic path to data layers supporting changeset filters when authorizing, authorizes each changeset, and merges the resulting policy filter into each changeset so the statement only touches authorized rows.\n\nThis issue affects ash: from 3.29.0 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:47:14.278Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-j7c9-3fw3-jc64"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82746.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82746"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/ed4e656822ffe83f8e960d5de0b573c0d1ae7f29"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82746",
"datePublished": "2026-09-01T03:47:14.278Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T15:17:12.056Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82745 (GCVE-0-2026-82745)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:42 – Updated: 2026-09-01 15:16
VLAI
EPSS
VEX
Title
ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness
Summary
Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert.
Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ETS and Mnesia data layers implemented create as a keyed insert that replaces any existing entry with the same primary key (lib/ash/data_layer/ets/ets.ex, lib/ash/data_layer/mnesia/mnesia.ex). An actor who can set the primary key on a create (for example a user-supplied string or integer key) can submit a create whose key matches an existing record and silently overwrite it, destroying and replacing another entity's data without going through the update action or its policies. The fix rejects a create whose primary key already exists with an already-taken error, and only allows duplicates for keyless resources.
This issue affects ash: from 0.4.0 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:16 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82745.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82745 | related |
| https://github.com/ash-project/ash/commit/912e243… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
0.4.0 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
6dc699d8a683d542812b34a8c104cc90164add3a , < 912e243196017c2a812c25905c2b1cc3bbb843fc
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82745",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:16:19.826687Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:16:38.003Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-92x7-q3h5-wf88"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.DataLayer.Ets\u0027",
"\u0027Elixir.Ash.DataLayer.Mnesia\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/data_layer/ets/ets.ex",
"lib/ash/data_layer/mnesia/mnesia.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.DataLayer.Ets\u0027:create/2"
},
{
"name": "\u0027Elixir.Ash.DataLayer.Mnesia\u0027:create/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "0.4.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.DataLayer.Ets\u0027",
"\u0027Elixir.Ash.DataLayer.Mnesia\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/data_layer/ets/ets.ex",
"lib/ash/data_layer/mnesia/mnesia.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.DataLayer.Ets\u0027:create/2"
},
{
"name": "\u0027Elixir.Ash.DataLayer.Mnesia\u0027:create/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "912e243196017c2a812c25905c2b1cc3bbb843fc",
"status": "affected",
"version": "6dc699d8a683d542812b34a8c104cc90164add3a",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "0.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert.\u003c/p\u003e\n\u003cp\u003eUnlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ETS and Mnesia data layers implemented \u003ccode\u003ecreate\u003c/code\u003e as a keyed insert that replaces any existing entry with the same primary key (\u003ccode\u003elib/ash/data_layer/ets/ets.ex\u003c/code\u003e, \u003ccode\u003elib/ash/data_layer/mnesia/mnesia.ex\u003c/code\u003e). An actor who can set the primary key on a create (for example a user-supplied string or integer key) can submit a create whose key matches an existing record and silently overwrite it, destroying and replacing another entity\u0027s data without going through the update action or its policies. The fix rejects a create whose primary key already exists with an already-taken error, and only allows duplicates for keyless resources.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 0.4.0 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert.\n\nUnlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ETS and Mnesia data layers implemented `create` as a keyed insert that replaces any existing entry with the same primary key (`lib/ash/data_layer/ets/ets.ex`, `lib/ash/data_layer/mnesia/mnesia.ex`). An actor who can set the primary key on a create (for example a user-supplied string or integer key) can submit a create whose key matches an existing record and silently overwrite it, destroying and replacing another entity\u0027s data without going through the update action or its policies. The fix rejects a create whose primary key already exists with an already-taken error, and only allows duplicates for keyless resources.\n\nThis issue affects ash: from 0.4.0 before 3.32.2."
}
],
"value": "Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert.\n\nUnlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ETS and Mnesia data layers implemented create as a keyed insert that replaces any existing entry with the same primary key (lib/ash/data_layer/ets/ets.ex, lib/ash/data_layer/mnesia/mnesia.ex). An actor who can set the primary key on a create (for example a user-supplied string or integer key) can submit a create whose key matches an existing record and silently overwrite it, destroying and replacing another entity\u0027s data without going through the update action or its policies. The fix rejects a create whose primary key already exists with an already-taken error, and only allows duplicates for keyless resources.\n\nThis issue affects ash: from 0.4.0 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:42:28.309Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-92x7-q3h5-wf88"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82745.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82745"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/912e243196017c2a812c25905c2b1cc3bbb843fc"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82745",
"datePublished": "2026-09-01T03:42:28.309Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T15:16:38.003Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82744 (GCVE-0-2026-82744)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:39 – Updated: 2026-09-01 15:15
VLAI
EPSS
VEX
Title
Ash.Reactor change step fails open, skipping a change when its where guard raises
Summary
Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not.
An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex) evaluated those guards in apply_where_clauses/3, and apply_validation rescued any exception into {:error, error}. The reduce treated that identically to a guard whose condition was simply not met and bypassed the change. So when a guard raises (for example on attacker-influenced input), a change that enforces a security-relevant modification is skipped rather than failing the step. The fix distinguishes a raised exception (now {:raised, error}) and halts the step with an error, failing closed.
This issue affects ash: from 3.0.0-rc.17 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:15 UTC
CWE
- CWE-636 - Not Failing Securely ('Failing Open')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82744.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82744 | related |
| https://github.com/ash-project/ash/commit/6d2eb86… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.0.0-rc.17 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
321f43bd05ad9544e693cbf797243693e51a6be4 , < 6d2eb86ea8d2ba5ffac89c1b8b9bf46e331feabc
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82744",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:15:37.062501Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:15:56.042Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-3xq4-m876-fr88"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Reactor.ChangeStep\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/reactor/steps/change_step.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Reactor.ChangeStep\u0027:apply_where_clauses/3"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "3.0.0-rc.17",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Reactor.ChangeStep\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/reactor/steps/change_step.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Reactor.ChangeStep\u0027:apply_where_clauses/3"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "6d2eb86ea8d2ba5ffac89c1b8b9bf46e331feabc",
"status": "affected",
"version": "321f43bd05ad9544e693cbf797243693e51a6be4",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "3.0.0-rc.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNot Failing Securely (Failing Open) vulnerability in ash-project ash skips an \u003ccode\u003eAsh.Reactor\u003c/code\u003e change when the guard controlling it raises, so a change meant to run does not.\u003c/p\u003e\n\u003cp\u003eAn \u003ccode\u003eAsh.Reactor\u003c/code\u003e \u003ccode\u003echange\u003c/code\u003e step can be gated by \u003ccode\u003ewhere\u003c/code\u003e validations that decide whether the change runs. \u003ccode\u003eAsh.Reactor.ChangeStep\u003c/code\u003e (\u003ccode\u003elib/ash/reactor/steps/change_step.ex\u003c/code\u003e) evaluated those guards in \u003ccode\u003eapply_where_clauses/3\u003c/code\u003e, and \u003ccode\u003eapply_validation\u003c/code\u003e rescued any exception into \u003ccode\u003e{:error, error}\u003c/code\u003e. The reduce treated that identically to a guard whose condition was simply not met and bypassed the change. So when a guard raises (for example on attacker-influenced input), a change that enforces a security-relevant modification is skipped rather than failing the step. The fix distinguishes a raised exception (now \u003ccode\u003e{:raised, error}\u003c/code\u003e) and halts the step with an error, failing closed.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.0.0-rc.17 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an `Ash.Reactor` change when the guard controlling it raises, so a change meant to run does not.\n\nAn `Ash.Reactor` `change` step can be gated by `where` validations that decide whether the change runs. `Ash.Reactor.ChangeStep` (`lib/ash/reactor/steps/change_step.ex`) evaluated those guards in `apply_where_clauses/3`, and `apply_validation` rescued any exception into `{:error, error}`. The reduce treated that identically to a guard whose condition was simply not met and bypassed the change. So when a guard raises (for example on attacker-influenced input), a change that enforces a security-relevant modification is skipped rather than failing the step. The fix distinguishes a raised exception (now `{:raised, error}`) and halts the step with an error, failing closed.\n\nThis issue affects ash: from 3.0.0-rc.17 before 3.32.2."
}
],
"value": "Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not.\n\nAn Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex) evaluated those guards in apply_where_clauses/3, and apply_validation rescued any exception into {:error, error}. The reduce treated that identically to a guard whose condition was simply not met and bypassed the change. So when a guard raises (for example on attacker-influenced input), a change that enforces a security-relevant modification is skipped rather than failing the step. The fix distinguishes a raised exception (now {:raised, error}) and halts the step with an error, failing closed.\n\nThis issue affects ash: from 3.0.0-rc.17 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-636",
"description": "CWE-636 Not Failing Securely (\u0027Failing Open\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:39:42.668Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-3xq4-m876-fr88"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82744.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82744"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/6d2eb86ea8d2ba5ffac89c1b8b9bf46e331feabc"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Reactor change step fails open, skipping a change when its where guard raises"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82744",
"datePublished": "2026-09-01T03:39:42.668Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T15:15:56.042Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82743 (GCVE-0-2026-82743)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:37 – Updated: 2026-09-01 12:40
VLAI
EPSS
VEX
Title
Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads
Summary
Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it.
Ash.Actions.Read.AsyncLimiter.await_at_least_one/1 (lib/ash/actions/read/async_limiter.ex) waited for concurrent async read tasks by polling each with Task.yield(task, 0) in a tight loop rather than blocking. While every outstanding task is still running (a slow related-data load or calculation), the loop returns immediately and repeats, busy-spinning and holding a BEAM scheduler at full CPU for the whole duration of the slow read; concurrent slow reads tie up further schedulers. The fix waits with Task.yield_many (a non-blocking sweep followed by a blocking wait with timeout: :infinity), so the process sleeps until a task completes instead of spinning.
This issue affects ash: from 2.19.0 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:39 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82743.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82743 | related |
| https://github.com/ash-project/ash/commit/0a5ecd2… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.19.0 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
c48cb08026cf56b1ac33209203bc9c00061b40b8 , < 0a5ecd2ffdfa848afdeb8827f02982ef2a63a1cd
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82743",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:39:40.600101Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:40:17.592Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-33wq-x3q2-c92h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Read.AsyncLimiter\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/read/async_limiter.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Read.AsyncLimiter\u0027:await_at_least_one/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "2.19.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Read.AsyncLimiter\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/read/async_limiter.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Read.AsyncLimiter\u0027:await_at_least_one/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0a5ecd2ffdfa848afdeb8827f02982ef2a63a1cd",
"status": "affected",
"version": "c48cb08026cf56b1ac33209203bc9c00061b40b8",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "2.19.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Actions.Read.AsyncLimiter.await_at_least_one/1\u003c/code\u003e (\u003ccode\u003elib/ash/actions/read/async_limiter.ex\u003c/code\u003e) waited for concurrent async read tasks by polling each with \u003ccode\u003eTask.yield(task, 0)\u003c/code\u003e in a tight loop rather than blocking. While every outstanding task is still running (a slow related-data load or calculation), the loop returns immediately and repeats, busy-spinning and holding a BEAM scheduler at full CPU for the whole duration of the slow read; concurrent slow reads tie up further schedulers. The fix waits with \u003ccode\u003eTask.yield_many\u003c/code\u003e (a non-blocking sweep followed by a blocking wait with \u003ccode\u003etimeout: :infinity\u003c/code\u003e), so the process sleeps until a task completes instead of spinning.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.19.0 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it.\n\n`Ash.Actions.Read.AsyncLimiter.await_at_least_one/1` (`lib/ash/actions/read/async_limiter.ex`) waited for concurrent async read tasks by polling each with `Task.yield(task, 0)` in a tight loop rather than blocking. While every outstanding task is still running (a slow related-data load or calculation), the loop returns immediately and repeats, busy-spinning and holding a BEAM scheduler at full CPU for the whole duration of the slow read; concurrent slow reads tie up further schedulers. The fix waits with `Task.yield_many` (a non-blocking sweep followed by a blocking wait with `timeout: :infinity`), so the process sleeps until a task completes instead of spinning.\n\nThis issue affects ash: from 2.19.0 before 3.32.2."
}
],
"value": "Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it.\n\nAsh.Actions.Read.AsyncLimiter.await_at_least_one/1 (lib/ash/actions/read/async_limiter.ex) waited for concurrent async read tasks by polling each with Task.yield(task, 0) in a tight loop rather than blocking. While every outstanding task is still running (a slow related-data load or calculation), the loop returns immediately and repeats, busy-spinning and holding a BEAM scheduler at full CPU for the whole duration of the slow read; concurrent slow reads tie up further schedulers. The fix waits with Task.yield_many (a non-blocking sweep followed by a blocking wait with timeout: :infinity), so the process sleeps until a task completes instead of spinning.\n\nThis issue affects ash: from 2.19.0 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-227",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-227 Sustained Client Engagement"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:37:24.292Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-33wq-x3q2-c92h"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82743.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82743"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/0a5ecd2ffdfa848afdeb8827f02982ef2a63a1cd"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82743",
"datePublished": "2026-09-01T03:37:24.292Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T12:40:17.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82742 (GCVE-0-2026-82742)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:35 – Updated: 2026-09-01 12:41
VLAI
EPSS
VEX
Title
Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory
Summary
Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory.
Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its related rows. flatten_relationships/2 (lib/ash/filter/runtime.ex) eagerly built the full Cartesian product across the filter's to-many relationship paths, so a record with K to-many relationships of M rows each materialized on the order of M^K scenarios before any predicate was checked. A filter or dataset that reaches several sizeable to-many relationships therefore allocates memory combinatorially and can exhaust the node. The fix streams the expansion lazily and short-circuits on the first matching scenario, bounding the work.
This issue affects ash: from 1.29.0-rc0 before 3.32.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:41 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82742.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82742 | related |
| https://github.com/ash-project/ash/commit/da07f00… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
1.29.0-rc0 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
f6f5d194bfc7802bd32e48bf2eabd2d97a0109a4 , < da07f009e889819ec410fa1f0f12534bfb9e21dd
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82742",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:41:35.557359Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:41:53.189Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Filter.Runtime\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/filter/runtime.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Filter.Runtime\u0027:filter_matches/4"
},
{
"name": "\u0027Elixir.Ash.Filter.Runtime\u0027:flatten_relationships/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "1.29.0-rc0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Filter.Runtime\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/filter/runtime.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Filter.Runtime\u0027:filter_matches/4"
},
{
"name": "\u0027Elixir.Ash.Filter.Runtime\u0027:flatten_relationships/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "da07f009e889819ec410fa1f0f12534bfb9e21dd",
"status": "affected",
"version": "f6f5d194bfc7802bd32e48bf2eabd2d97a0109a4",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "1.29.0-rc0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Filter.Runtime\u003c/code\u003e matches a filter against an in-memory record by first expanding the record into combinations of its related rows. \u003ccode\u003eflatten_relationships/2\u003c/code\u003e (\u003ccode\u003elib/ash/filter/runtime.ex\u003c/code\u003e) eagerly built the full Cartesian product across the filter\u0027s to-many relationship paths, so a record with K to-many relationships of M rows each materialized on the order of M^K scenarios before any predicate was checked. A filter or dataset that reaches several sizeable to-many relationships therefore allocates memory combinatorially and can exhaust the node. The fix streams the expansion lazily and short-circuits on the first matching scenario, bounding the work.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 1.29.0-rc0 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory.\n\n`Ash.Filter.Runtime` matches a filter against an in-memory record by first expanding the record into combinations of its related rows. `flatten_relationships/2` (`lib/ash/filter/runtime.ex`) eagerly built the full Cartesian product across the filter\u0027s to-many relationship paths, so a record with K to-many relationships of M rows each materialized on the order of M^K scenarios before any predicate was checked. A filter or dataset that reaches several sizeable to-many relationships therefore allocates memory combinatorially and can exhaust the node. The fix streams the expansion lazily and short-circuits on the first matching scenario, bounding the work.\n\nThis issue affects ash: from 1.29.0-rc0 before 3.32.2."
}
],
"value": "Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory.\n\nAsh.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its related rows. flatten_relationships/2 (lib/ash/filter/runtime.ex) eagerly built the full Cartesian product across the filter\u0027s to-many relationship paths, so a record with K to-many relationships of M rows each materialized on the order of M^K scenarios before any predicate was checked. A filter or dataset that reaches several sizeable to-many relationships therefore allocates memory combinatorially and can exhaust the node. The fix streams the expansion lazily and short-circuits on the first matching scenario, bounding the work.\n\nThis issue affects ash: from 1.29.0-rc0 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:35:18.551Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-mgwj-c69v-6f83"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82742.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82742"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/da07f009e889819ec410fa1f0f12534bfb9e21dd"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82742",
"datePublished": "2026-09-01T03:35:18.551Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T12:41:53.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82741 (GCVE-0-2026-82741)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:33 – Updated: 2026-09-01 15:13
VLAI
EPSS
VEX
Title
Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion
Summary
Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :map_with_tag, bypassing that member's validation and any tag-based authorization.
For a union with storage: :map_with_tag, each member is identified in storage by a configured tag and tag_value. Ash.Type.Union.dump_to_native/2 (lib/ash/type/union.ex) did not force the configured tag when writing the value, so a tag carried in the submitted value was persisted verbatim. An attacker can therefore store a value whose data belongs to one member but whose tag names a different member. On read the value is re-selected by its tag and treated as the incompatible member (a type confusion), bypassing the real member's constraints and any logic or policy that branches on the union tag. The fix drops any incoming tag and forces the configured tag value on dump.
This issue affects ash: from 2.14.18 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:12 UTC
CWE
- CWE-1287 - Improper Validation of Specified Type of Input
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82741.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82741 | related |
| https://github.com/ash-project/ash/commit/8dbdaec… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.14.18 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
b0bd2d23d979e731610327636f51da4981fcef68 , < 8dbdaecd0f115f52e7c3f9a3e798617d6fbf5f7d
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82741",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:12:48.327448Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:13:10.142Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-2mmm-gc86-7jgg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.Union\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/union.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.Union\u0027:dump_to_native/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "2.14.18",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.Union\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/union.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.Union\u0027:dump_to_native/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "8dbdaecd0f115f52e7c3f9a3e798617d6fbf5f7d",
"status": "affected",
"version": "b0bd2d23d979e731610327636f51da4981fcef68",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "2.14.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an \u003ccode\u003eAsh.Type.Union\u003c/code\u003e value that uses \u003ccode\u003estorage: :map_with_tag\u003c/code\u003e, bypassing that member\u0027s validation and any tag-based authorization.\u003c/p\u003e\n\u003cp\u003eFor a union with \u003ccode\u003estorage: :map_with_tag\u003c/code\u003e, each member is identified in storage by a configured \u003ccode\u003etag\u003c/code\u003e and \u003ccode\u003etag_value\u003c/code\u003e. \u003ccode\u003eAsh.Type.Union.dump_to_native/2\u003c/code\u003e (\u003ccode\u003elib/ash/type/union.ex\u003c/code\u003e) did not force the configured tag when writing the value, so a tag carried in the submitted value was persisted verbatim. An attacker can therefore store a value whose data belongs to one member but whose tag names a different member. On read the value is re-selected by its tag and treated as the incompatible member (a type confusion), bypassing the real member\u0027s constraints and any logic or policy that branches on the union tag. The fix drops any incoming tag and forces the configured tag value on dump.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.14.18 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an `Ash.Type.Union` value that uses `storage: :map_with_tag`, bypassing that member\u0027s validation and any tag-based authorization.\n\nFor a union with `storage: :map_with_tag`, each member is identified in storage by a configured `tag` and `tag_value`. `Ash.Type.Union.dump_to_native/2` (`lib/ash/type/union.ex`) did not force the configured tag when writing the value, so a tag carried in the submitted value was persisted verbatim. An attacker can therefore store a value whose data belongs to one member but whose tag names a different member. On read the value is re-selected by its tag and treated as the incompatible member (a type confusion), bypassing the real member\u0027s constraints and any logic or policy that branches on the union tag. The fix drops any incoming tag and forces the configured tag value on dump.\n\nThis issue affects ash: from 2.14.18 before 3.32.2."
}
],
"value": "Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :map_with_tag, bypassing that member\u0027s validation and any tag-based authorization.\n\nFor a union with storage: :map_with_tag, each member is identified in storage by a configured tag and tag_value. Ash.Type.Union.dump_to_native/2 (lib/ash/type/union.ex) did not force the configured tag when writing the value, so a tag carried in the submitted value was persisted verbatim. An attacker can therefore store a value whose data belongs to one member but whose tag names a different member. On read the value is re-selected by its tag and treated as the incompatible member (a type confusion), bypassing the real member\u0027s constraints and any logic or policy that branches on the union tag. The fix drops any incoming tag and forces the configured tag value on dump.\n\nThis issue affects ash: from 2.14.18 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1287",
"description": "CWE-1287 Improper Validation of Specified Type of Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:33:03.442Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-2mmm-gc86-7jgg"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82741.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82741"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/8dbdaecd0f115f52e7c3f9a3e798617d6fbf5f7d"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82741",
"datePublished": "2026-09-01T03:33:03.442Z",
"dateReserved": "2026-08-31T00:59:10.002Z",
"dateUpdated": "2026-09-01T15:13:10.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82740 (GCVE-0-2026-82740)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:29 – Updated: 2026-09-01 12:42
VLAI
EPSS
VEX
Title
Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs
Summary
Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested {:array, {:array, type}} attribute, letting invalid input pass validation.
Ash.Type.apply_constraints/3 (lib/ash/type/type.ex) handled the {:array, {:array, type}} case by mapping only the inner {:array, type} constraints over each element, so constraints declared on the outer array (such as min_length, max_length, and nil_items?) were never applied. An attacker could submit an outer list that violates those constraints (too many elements, or nil entries where disallowed) and have it accepted and persisted. The fix enforces the outer array constraints and adds explicit handling for nil and non-list inputs.
This issue affects ash: from 2.16.1 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:42 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82740.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82740 | related |
| https://github.com/ash-project/ash/commit/c85ccff… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.16.1 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
7b50a401d85018371659e51c34c89d7e1d0c2ac9 , < c85ccff7dc6e3b0b3e40ad788b0056b3b6bee5ce
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82740",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:42:32.300749Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:42:58.541Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-v29m-p28g-w5fc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/type.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type\u0027:apply_constraints/3"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "2.16.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/type.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type\u0027:apply_constraints/3"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "c85ccff7dc6e3b0b3e40ad788b0056b3b6bee5ce",
"status": "affected",
"version": "7b50a401d85018371659e51c34c89d7e1d0c2ac9",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "2.16.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested \u003ccode\u003e{:array, {:array, type}}\u003c/code\u003e attribute, letting invalid input pass validation.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Type.apply_constraints/3\u003c/code\u003e (\u003ccode\u003elib/ash/type/type.ex\u003c/code\u003e) handled the \u003ccode\u003e{:array, {:array, type}}\u003c/code\u003e case by mapping only the inner \u003ccode\u003e{:array, type}\u003c/code\u003e constraints over each element, so constraints declared on the outer array (such as \u003ccode\u003emin_length\u003c/code\u003e, \u003ccode\u003emax_length\u003c/code\u003e, and \u003ccode\u003enil_items?\u003c/code\u003e) were never applied. An attacker could submit an outer list that violates those constraints (too many elements, or \u003ccode\u003enil\u003c/code\u003e entries where disallowed) and have it accepted and persisted. The fix enforces the outer array constraints and adds explicit handling for \u003ccode\u003enil\u003c/code\u003e and non-list inputs.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.16.1 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested `{:array, {:array, type}}` attribute, letting invalid input pass validation.\n\n`Ash.Type.apply_constraints/3` (`lib/ash/type/type.ex`) handled the `{:array, {:array, type}}` case by mapping only the inner `{:array, type}` constraints over each element, so constraints declared on the outer array (such as `min_length`, `max_length`, and `nil_items?`) were never applied. An attacker could submit an outer list that violates those constraints (too many elements, or `nil` entries where disallowed) and have it accepted and persisted. The fix enforces the outer array constraints and adds explicit handling for `nil` and non-list inputs.\n\nThis issue affects ash: from 2.16.1 before 3.32.2."
}
],
"value": "Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested {:array, {:array, type}} attribute, letting invalid input pass validation.\n\nAsh.Type.apply_constraints/3 (lib/ash/type/type.ex) handled the {:array, {:array, type}} case by mapping only the inner {:array, type} constraints over each element, so constraints declared on the outer array (such as min_length, max_length, and nil_items?) were never applied. An attacker could submit an outer list that violates those constraints (too many elements, or nil entries where disallowed) and have it accepted and persisted. The fix enforces the outer array constraints and adds explicit handling for nil and non-list inputs.\n\nThis issue affects ash: from 2.16.1 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:29:11.804Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-v29m-p28g-w5fc"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82740.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82740"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/c85ccff7dc6e3b0b3e40ad788b0056b3b6bee5ce"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82740",
"datePublished": "2026-09-01T03:29:11.804Z",
"dateReserved": "2026-08-31T00:59:10.002Z",
"dateUpdated": "2026-09-01T12:42:58.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82739 (GCVE-0-2026-82739)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:27 – Updated: 2026-09-01 12:44
VLAI
EPSS
VEX
Title
Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.
Ash.Resource.Validation.Confirm's atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field's current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.
This issue affects ash: from 2.17.20 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:43 UTC
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82739.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82739 | related |
| https://github.com/ash-project/ash/commit/7dfe5f0… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.17.20 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
fadecf3ee95640bd3bc7298df4799e0375537fd2 , < 7dfe5f0b1ba4267580ded947dc861351d4dc8e2b
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82739",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:43:57.417588Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:44:21.482Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-66cg-vj5m-8w7v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Resource.Validation.Confirm\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/resource/validation/confirm.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027:atomic/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "2.17.20",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Resource.Validation.Confirm\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/resource/validation/confirm.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027:atomic/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "7dfe5f0b1ba4267580ded947dc861351d4dc8e2b",
"status": "affected",
"version": "fadecf3ee95640bd3bc7298df4799e0375537fd2",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "2.17.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Resource.Validation.Confirm\u003c/code\u003e\u0027s atomic implementation (\u003ccode\u003eatomic/2\u003c/code\u003e in \u003ccode\u003elib/ash/resource/validation/confirm.ex\u003c/code\u003e) built the mismatch error with its \u003ccode\u003evalue\u003c/code\u003e set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, \u003ccode\u003evalue\u003c/code\u003e resolves through \u003ccode\u003eatomic_ref/2\u003c/code\u003e to the field\u0027s current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.17.20 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.\n\n`Ash.Resource.Validation.Confirm`\u0027s atomic implementation (`atomic/2` in `lib/ash/resource/validation/confirm.ex`) built the mismatch error with its `value` set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, `value` resolves through `atomic_ref/2` to the field\u0027s current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.\n\nThis issue affects ash: from 2.17.20 before 3.32.2."
}
],
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.\n\nAsh.Resource.Validation.Confirm\u0027s atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field\u0027s current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.\n\nThis issue affects ash: from 2.17.20 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-54",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-54 Query System for Information"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:27:58.165Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-66cg-vj5m-8w7v"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82739.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82739"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/7dfe5f0b1ba4267580ded947dc861351d4dc8e2b"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Resource.Validation.Confirm leaks a confirmed field\u0027s stored value in the atomic mismatch error"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82739",
"datePublished": "2026-09-01T03:27:58.165Z",
"dateReserved": "2026-08-31T00:59:10.002Z",
"dateUpdated": "2026-09-01T12:44:21.482Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82738 (GCVE-0-2026-82738)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:26 – Updated: 2026-09-01 12:47
VLAI
EPSS
VEX
Title
Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service
Summary
Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute.
Ash.Type.UUIDv7.cast_input/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a 16-byte binary. On read, cast_stored/2 (lib/ash/type/uuid_v7.ex) routes the stored binary back through cast_input/2, which since an input-validation tightening in v3.6.3 matches only version-7 (and optionally version-4) 16-byte binaries and otherwise expects a 36-character string. A stored non-v7 16-byte binary matches neither clause and returns :error, so every later read of that record fails. An attacker able to set such an attribute poisons the row permanently. The fix decodes any 16-byte stored binary directly in cast_stored/2.
This issue affects ash: from 3.6.3 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:46 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82738.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82738 | related |
| https://github.com/ash-project/ash/commit/c453cdc… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.6.3 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
751d8a4d11564efbe358c90c8347f3a00eb60782 , < c453cdc0b8570e86ffef0d10e136247f52b3ea76
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82738",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:46:45.556475Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:47:34.853Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-7xfw-9jwm-9c4c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.UUIDv7\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/uuid_v7.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.UUIDv7\u0027:cast_input/2"
},
{
"name": "\u0027Elixir.Ash.Type.UUIDv7\u0027:cast_stored/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "3.6.3",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.UUIDv7\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/uuid_v7.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.UUIDv7\u0027:cast_input/2"
},
{
"name": "\u0027Elixir.Ash.Type.UUIDv7\u0027:cast_stored/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "c453cdc0b8570e86ffef0d10e136247f52b3ea76",
"status": "affected",
"version": "751d8a4d11564efbe358c90c8347f3a00eb60782",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "3.6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an \u003ccode\u003eAsh.Type.UUIDv7\u003c/code\u003e attribute.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Type.UUIDv7.cast_input/2\u003c/code\u003e accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a 16-byte binary. On read, \u003ccode\u003ecast_stored/2\u003c/code\u003e (\u003ccode\u003elib/ash/type/uuid_v7.ex\u003c/code\u003e) routes the stored binary back through \u003ccode\u003ecast_input/2\u003c/code\u003e, which since an input-validation tightening in v3.6.3 matches only version-7 (and optionally version-4) 16-byte binaries and otherwise expects a 36-character string. A stored non-v7 16-byte binary matches neither clause and returns \u003ccode\u003e:error\u003c/code\u003e, so every later read of that record fails. An attacker able to set such an attribute poisons the row permanently. The fix decodes any 16-byte stored binary directly in \u003ccode\u003ecast_stored/2\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.6.3 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an `Ash.Type.UUIDv7` attribute.\n\n`Ash.Type.UUIDv7.cast_input/2` accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a 16-byte binary. On read, `cast_stored/2` (`lib/ash/type/uuid_v7.ex`) routes the stored binary back through `cast_input/2`, which since an input-validation tightening in v3.6.3 matches only version-7 (and optionally version-4) 16-byte binaries and otherwise expects a 36-character string. A stored non-v7 16-byte binary matches neither clause and returns `:error`, so every later read of that record fails. An attacker able to set such an attribute poisons the row permanently. The fix decodes any 16-byte stored binary directly in `cast_stored/2`.\n\nThis issue affects ash: from 3.6.3 before 3.32.2."
}
],
"value": "Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute.\n\nAsh.Type.UUIDv7.cast_input/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a 16-byte binary. On read, cast_stored/2 (lib/ash/type/uuid_v7.ex) routes the stored binary back through cast_input/2, which since an input-validation tightening in v3.6.3 matches only version-7 (and optionally version-4) 16-byte binaries and otherwise expects a 36-character string. A stored non-v7 16-byte binary matches neither clause and returns :error, so every later read of that record fails. An attacker able to set such an attribute poisons the row permanently. The fix decodes any 16-byte stored binary directly in cast_stored/2.\n\nThis issue affects ash: from 3.6.3 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:26:23.035Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-7xfw-9jwm-9c4c"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82738.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82738"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/c453cdc0b8570e86ffef0d10e136247f52b3ea76"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82738",
"datePublished": "2026-09-01T03:26:23.035Z",
"dateReserved": "2026-08-31T00:59:10.002Z",
"dateUpdated": "2026-09-01T12:47:34.853Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82737 (GCVE-0-2026-82737)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:24 – Updated: 2026-09-01 12:56
VLAI
EPSS
VEX
Title
Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads
Summary
Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.
Ash.Vector.new/1 (lib/ash/vector.ex) encodes a vector as <<dim::unsigned-16, 0::unsigned-16>> followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. from_binary/1 later reads binary-size(dim)-unit(32) from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.
This issue affects ash: from 2.14.13 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:55 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82737.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82737 | related |
| https://github.com/ash-project/ash/commit/cef5eb7… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.14.13 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
e2855843ca4a9141dcd7f40f47227e13b43f0e00 , < cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82737",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:55:44.794250Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:56:53.991Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-68q3-w4w3-2gfv"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Vector\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/vector.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Vector\u0027:new/1"
},
{
"name": "\u0027Elixir.Ash.Vector\u0027:from_binary/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "2.14.13",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Vector\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/vector.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Vector\u0027:new/1"
},
{
"name": "\u0027Elixir.Ash.Vector\u0027:from_binary/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe",
"status": "affected",
"version": "e2855843ca4a9141dcd7f40f47227e13b43f0e00",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "2.14.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInteger Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Vector.new/1\u003c/code\u003e (\u003ccode\u003elib/ash/vector.ex\u003c/code\u003e) encodes a vector as \u003ccode\u003e\u0026lt;\u0026lt;dim::unsigned-16, 0::unsigned-16\u0026gt;\u0026gt;\u003c/code\u003e followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. \u003ccode\u003efrom_binary/1\u003c/code\u003e later reads \u003ccode\u003ebinary-size(dim)-unit(32)\u003c/code\u003e from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.14.13 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.\n\n`Ash.Vector.new/1` (`lib/ash/vector.ex`) encodes a vector as `\u003c\u003cdim::unsigned-16, 0::unsigned-16\u003e\u003e` followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. `from_binary/1` later reads `binary-size(dim)-unit(32)` from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.\n\nThis issue affects ash: from 2.14.13 before 3.32.2."
}
],
"value": "Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.\n\nAsh.Vector.new/1 (lib/ash/vector.ex) encodes a vector as \u003c\u003cdim::unsigned-16, 0::unsigned-16\u003e\u003e followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. from_binary/1 later reads binary-size(dim)-unit(32) from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.\n\nThis issue affects ash: from 2.14.13 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-92",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-92 Forced Integer Overflow"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:24:14.969Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-68q3-w4w3-2gfv"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82737.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82737"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82737",
"datePublished": "2026-09-01T03:24:14.969Z",
"dateReserved": "2026-08-31T00:59:10.002Z",
"dateUpdated": "2026-09-01T12:56:53.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82736 (GCVE-0-2026-82736)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:21 – Updated: 2026-09-01 13:06
VLAI
EPSS
VEX
Title
Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass
Summary
Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints.
Ash.Type.CiString.apply_constraints/2 (lib/ash/type/ci_string.ex) validated the max_length, min_length, and match constraints against the value as submitted, while the type case-folds the string (per its casing) for storage and comparison. Because validation ran before folding, an attacker can submit a value whose folded form breaks a constraint but whose original form passes: for example, against a match pattern requiring uppercase, an uppercase value that is stored lowercased persists a value the pattern rejects. The fix case-folds the value at the start of apply_constraints/2, so the constraints are checked against the form that is actually stored.
This issue affects ash: from 1.29.0-rc0 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:58 UTC
CWE
- CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82736.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82736 | related |
| https://github.com/ash-project/ash/commit/d8320b0… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
1.29.0-rc0 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
f6f5d194bfc7802bd32e48bf2eabd2d97a0109a4 , < d8320b0127c8ef453679d70e5dd23a9506951d21
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82736",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:58:09.993835Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T13:06:35.213Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-gg9w-7593-hxg9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.CiString\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/ci_string.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.CiString\u0027:apply_constraints/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "1.29.0-rc0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.CiString\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/ci_string.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.CiString\u0027:apply_constraints/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "d8320b0127c8ef453679d70e5dd23a9506951d21",
"status": "affected",
"version": "f6f5d194bfc7802bd32e48bf2eabd2d97a0109a4",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "1.29.0-rc0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Type.CiString.apply_constraints/2\u003c/code\u003e (\u003ccode\u003elib/ash/type/ci_string.ex\u003c/code\u003e) validated the \u003ccode\u003emax_length\u003c/code\u003e, \u003ccode\u003emin_length\u003c/code\u003e, and \u003ccode\u003ematch\u003c/code\u003e constraints against the value as submitted, while the type case-folds the string (per its \u003ccode\u003ecasing\u003c/code\u003e) for storage and comparison. Because validation ran before folding, an attacker can submit a value whose folded form breaks a constraint but whose original form passes: for example, against a match pattern requiring uppercase, an uppercase value that is stored lowercased persists a value the pattern rejects. The fix case-folds the value at the start of \u003ccode\u003eapply_constraints/2\u003c/code\u003e, so the constraints are checked against the form that is actually stored.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 1.29.0-rc0 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints.\n\n`Ash.Type.CiString.apply_constraints/2` (`lib/ash/type/ci_string.ex`) validated the `max_length`, `min_length`, and `match` constraints against the value as submitted, while the type case-folds the string (per its `casing`) for storage and comparison. Because validation ran before folding, an attacker can submit a value whose folded form breaks a constraint but whose original form passes: for example, against a match pattern requiring uppercase, an uppercase value that is stored lowercased persists a value the pattern rejects. The fix case-folds the value at the start of `apply_constraints/2`, so the constraints are checked against the form that is actually stored.\n\nThis issue affects ash: from 1.29.0-rc0 before 3.32.2."
}
],
"value": "Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints.\n\nAsh.Type.CiString.apply_constraints/2 (lib/ash/type/ci_string.ex) validated the max_length, min_length, and match constraints against the value as submitted, while the type case-folds the string (per its casing) for storage and comparison. Because validation ran before folding, an attacker can submit a value whose folded form breaks a constraint but whose original form passes: for example, against a match pattern requiring uppercase, an uppercase value that is stored lowercased persists a value the pattern rejects. The fix case-folds the value at the start of apply_constraints/2, so the constraints are checked against the form that is actually stored.\n\nThis issue affects ash: from 1.29.0-rc0 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-267",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-267 Leverage Alternate Encoding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-180",
"description": "CWE-180 Incorrect Behavior Order: Validate Before Canonicalize",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:21:47.332Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-gg9w-7593-hxg9"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82736.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82736"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/d8320b0127c8ef453679d70e5dd23a9506951d21"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82736",
"datePublished": "2026-09-01T03:21:47.332Z",
"dateReserved": "2026-08-31T00:59:10.001Z",
"dateUpdated": "2026-09-01T13:06:35.213Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}