Vulnerability-Lookup

CVE-2026-82734 (GCVE-0-2026-82734)

Vulnerability from cvelistv5 – Published: 2026-09-01 03:17 – Updated: 2026-09-01 15:15

Title

Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal

Summary

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value. Ash.Type.Decimal cast input through Ecto's decimal cast in cast_input/2 and cast_stored/2 (lib/ash/type/decimal.ex) without checking that the resulting value is finite. Elixir's Decimal represents Infinity and NaN as valid structs, so a value such as "Infinity" or "NaN" passed casting and was persisted. Because NaN compares as false against every bound, min and max constraints do not reject it, and the stored special value later raises when used in Decimal arithmetic or is refused by the data layer, failing subsequent requests. The fix rejects any non-finite Decimal during casting. This issue affects ash: from 1.28.0 before 3.32.2.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-01 15:14 UTC

CWE

CWE-1284 - Improper Validation of Specified Quantity in Input

Assigner

EEF mitre root

References

4 references

URL	Tags
https://github.com/ash-project/ash/security/advis…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-82734.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-82734	related
https://github.com/ash-project/ash/commit/818087b…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
ash-project	ash	Affected: 1.28.0 , < 3.32.2 (semver) cpe:2.3:a:ash-project:ash::::::::
ash-project	ash	Affected: db6bdfcf1518c70d67975efb140cdeb2cb6a76e7 , < 818087b1b3364f2af6f5460d6b01262ad0f69204 (git) cpe:2.3:a:ash-project:ash::::::::

Credits

Jonatan Männchen / EEF Zach Daniel / Ash Project Peter Ullrich Peter Ullrich

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82734",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T15:14:56.006491Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T15:15:19.108Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ash-project/ash/security/advisories/GHSA-mvvh-q33h-q62v"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Ash.Type.Decimal\u0027"
          ],
          "packageName": "ash",
          "packageURL": "pkg:hex/ash",
          "product": "ash",
          "programFiles": [
            "lib/ash/type/decimal.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Ash.Type.Decimal\u0027:cast_input/2"
            },
            {
              "name": "\u0027Elixir.Ash.Type.Decimal\u0027:cast_stored/2"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "3.32.2",
              "status": "affected",
              "version": "1.28.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Ash.Type.Decimal\u0027"
          ],
          "packageName": "ash-project/ash",
          "packageURL": "pkg:github/ash-project/ash",
          "product": "ash",
          "programFiles": [
            "lib/ash/type/decimal.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Ash.Type.Decimal\u0027:cast_input/2"
            },
            {
              "name": "\u0027Elixir.Ash.Type.Decimal\u0027:cast_stored/2"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "818087b1b3364f2af6f5460d6b01262ad0f69204",
              "status": "affected",
              "version": "db6bdfcf1518c70d67975efb140cdeb2cb6a76e7",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.32.2",
                  "versionStartIncluding": "1.28.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel / Ash Project"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Type.Decimal\u003c/code\u003e cast input through Ecto\u0027s decimal cast in \u003ccode\u003ecast_input/2\u003c/code\u003e and \u003ccode\u003ecast_stored/2\u003c/code\u003e (\u003ccode\u003elib/ash/type/decimal.ex\u003c/code\u003e) without checking that the resulting value is finite. Elixir\u0027s \u003ccode\u003eDecimal\u003c/code\u003e represents \u003ccode\u003eInfinity\u003c/code\u003e and \u003ccode\u003eNaN\u003c/code\u003e as valid structs, so a value such as \u003ccode\u003e\"Infinity\"\u003c/code\u003e or \u003ccode\u003e\"NaN\"\u003c/code\u003e passed casting and was persisted. Because \u003ccode\u003eNaN\u003c/code\u003e compares as false against every bound, \u003ccode\u003emin\u003c/code\u003e and \u003ccode\u003emax\u003c/code\u003e constraints do not reject it, and the stored special value later raises when used in \u003ccode\u003eDecimal\u003c/code\u003e arithmetic or is refused by the data layer, failing subsequent requests. The fix rejects any non-finite \u003ccode\u003eDecimal\u003c/code\u003e during casting.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 1.28.0 before 3.32.2.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value.\n\n`Ash.Type.Decimal` cast input through Ecto\u0027s decimal cast in `cast_input/2` and `cast_stored/2` (`lib/ash/type/decimal.ex`) without checking that the resulting value is finite. Elixir\u0027s `Decimal` represents `Infinity` and `NaN` as valid structs, so a value such as `\"Infinity\"` or `\"NaN\"` passed casting and was persisted. Because `NaN` compares as false against every bound, `min` and `max` constraints do not reject it, and the stored special value later raises when used in `Decimal` arithmetic or is refused by the data layer, failing subsequent requests. The fix rejects any non-finite `Decimal` during casting.\n\nThis issue affects ash: from 1.28.0 before 3.32.2."
            }
          ],
          "value": "Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value.\n\nAsh.Type.Decimal cast input through Ecto\u0027s decimal cast in cast_input/2 and cast_stored/2 (lib/ash/type/decimal.ex) without checking that the resulting value is finite. Elixir\u0027s Decimal represents Infinity and NaN as valid structs, so a value such as \"Infinity\" or \"NaN\" passed casting and was persisted. Because NaN compares as false against every bound, min and max constraints do not reject it, and the stored special value later raises when used in Decimal arithmetic or is refused by the data layer, failing subsequent requests. The fix rejects any non-finite Decimal during casting.\n\nThis issue affects ash: from 1.28.0 before 3.32.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T03:17:15.389Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ash-project/ash/security/advisories/GHSA-mvvh-q33h-q62v"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-82734.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82734"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ash-project/ash/commit/818087b1b3364f2af6f5460d6b01262ad0f69204"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-82734",
    "datePublished": "2026-09-01T03:17:15.389Z",
    "dateReserved": "2026-08-31T00:59:10.001Z",
    "dateUpdated": "2026-09-01T15:15:19.108Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-82734",
      "date": "2026-09-04",
      "epss": "0.00133",
      "percentile": "0.03121"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-82734\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-09-01T04:18:02.600\",\"lastModified\":\"2026-09-01T21:15:00.147\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value.\\n\\nAsh.Type.Decimal cast input through Ecto\u0027s decimal cast in cast_input/2 and cast_stored/2 (lib/ash/type/decimal.ex) without checking that the resulting value is finite. Elixir\u0027s Decimal represents Infinity and NaN as valid structs, so a value such as \\\"Infinity\\\" or \\\"NaN\\\" passed casting and was persisted. Because NaN compares as false against every bound, min and max constraints do not reject it, and the stored special value later raises when used in Decimal arithmetic or is refused by the data layer, failing subsequent requests. The fix rejects any non-finite Decimal during casting.\\n\\nThis issue affects ash: from 1.28.0 before 3.32.2.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"ash-project\",\"product\":\"ash\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"ash\",\"cpes\":[\"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.Ash.Type.Decimal\u0027\"],\"programFiles\":[\"lib/ash/type/decimal.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.Ash.Type.Decimal\u0027:cast_input/2\"},{\"name\":\"\u0027Elixir.Ash.Type.Decimal\u0027:cast_stored/2\"}],\"repo\":\"https://github.com/ash-project/ash\",\"packageURL\":\"pkg:hex/ash\",\"versions\":[{\"version\":\"1.28.0\",\"lessThan\":\"3.32.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"ash-project\",\"product\":\"ash\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"ash-project/ash\",\"cpes\":[\"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.Ash.Type.Decimal\u0027\"],\"programFiles\":[\"lib/ash/type/decimal.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.Ash.Type.Decimal\u0027:cast_input/2\"},{\"name\":\"\u0027Elixir.Ash.Type.Decimal\u0027:cast_stored/2\"}],\"repo\":\"https://github.com/ash-project/ash\",\"packageURL\":\"pkg:github/ash-project/ash\",\"versions\":[{\"version\":\"db6bdfcf1518c70d67975efb140cdeb2cb6a76e7\",\"lessThan\":\"818087b1b3364f2af6f5460d6b01262ad0f69204\",\"versionType\":\"git\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":2.1,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-01T15:14:56.006491Z\",\"id\":\"CVE-2026-82734\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1284\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-82734.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash/commit/818087b1b3364f2af6f5460d6b01262ad0f69204\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash/security/advisories/GHSA-mvvh-q33h-q62v\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-82734\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash/security/advisories/GHSA-mvvh-q33h-q62v\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-82734\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-01T15:14:56.006491Z\"}}}], \"references\": [{\"url\": \"https://github.com/ash-project/ash/security/advisories/GHSA-mvvh-q33h-q62v\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-01T15:15:15.613Z\"}}], \"cna\": {\"title\": \"Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Zach Daniel / Ash Project\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}], \"impacts\": [{\"capecId\": \"CAPEC-153\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-153 Input Data Manipulation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 2.1, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"LOCAL\", \"baseSeverity\": \"LOW\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ash-project/ash\", \"vendor\": \"ash-project\", \"modules\": [\"\u0027Elixir.Ash.Type.Decimal\u0027\"], \"product\": \"ash\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.28.0\", \"lessThan\": \"3.32.2\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/ash\", \"packageName\": \"ash\", \"programFiles\": [\"lib/ash/type/decimal.ex\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.Ash.Type.Decimal\u0027:cast_input/2\"}, {\"name\": \"\u0027Elixir.Ash.Type.Decimal\u0027:cast_stored/2\"}]}, {\"cpes\": [\"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ash-project/ash\", \"vendor\": \"ash-project\", \"modules\": [\"\u0027Elixir.Ash.Type.Decimal\u0027\"], \"product\": \"ash\", \"versions\": [{\"status\": \"affected\", \"version\": \"db6bdfcf1518c70d67975efb140cdeb2cb6a76e7\", \"lessThan\": \"818087b1b3364f2af6f5460d6b01262ad0f69204\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/ash-project/ash\", \"packageName\": \"ash-project/ash\", \"programFiles\": [\"lib/ash/type/decimal.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.Ash.Type.Decimal\u0027:cast_input/2\"}, {\"name\": \"\u0027Elixir.Ash.Type.Decimal\u0027:cast_stored/2\"}]}], \"references\": [{\"url\": \"https://github.com/ash-project/ash/security/advisories/GHSA-mvvh-q33h-q62v\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-82734.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-82734\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/ash-project/ash/commit/818087b1b3364f2af6f5460d6b01262ad0f69204\", \"tags\": [\"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value.\\n\\nAsh.Type.Decimal cast input through Ecto\u0027s decimal cast in cast_input/2 and cast_stored/2 (lib/ash/type/decimal.ex) without checking that the resulting value is finite. Elixir\u0027s Decimal represents Infinity and NaN as valid structs, so a value such as \\\"Infinity\\\" or \\\"NaN\\\" passed casting and was persisted. Because NaN compares as false against every bound, min and max constraints do not reject it, and the stored special value later raises when used in Decimal arithmetic or is refused by the data layer, failing subsequent requests. The fix rejects any non-finite Decimal during casting.\\n\\nThis issue affects ash: from 1.28.0 before 3.32.2.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eImproper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value.\u003c/p\u003e\\n\u003cp\u003e\u003ccode\u003eAsh.Type.Decimal\u003c/code\u003e cast input through Ecto\u0027s decimal cast in \u003ccode\u003ecast_input/2\u003c/code\u003e and \u003ccode\u003ecast_stored/2\u003c/code\u003e (\u003ccode\u003elib/ash/type/decimal.ex\u003c/code\u003e) without checking that the resulting value is finite. Elixir\u0027s \u003ccode\u003eDecimal\u003c/code\u003e represents \u003ccode\u003eInfinity\u003c/code\u003e and \u003ccode\u003eNaN\u003c/code\u003e as valid structs, so a value such as \u003ccode\u003e\\\"Infinity\\\"\u003c/code\u003e or \u003ccode\u003e\\\"NaN\\\"\u003c/code\u003e passed casting and was persisted. Because \u003ccode\u003eNaN\u003c/code\u003e compares as false against every bound, \u003ccode\u003emin\u003c/code\u003e and \u003ccode\u003emax\u003c/code\u003e constraints do not reject it, and the stored special value later raises when used in \u003ccode\u003eDecimal\u003c/code\u003e arithmetic or is refused by the data layer, failing subsequent requests. The fix rejects any non-finite \u003ccode\u003eDecimal\u003c/code\u003e during casting.\u003c/p\u003e\\n\u003cp\u003eThis issue affects ash: from 1.28.0 before 3.32.2.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value.\\n\\n`Ash.Type.Decimal` cast input through Ecto\u0027s decimal cast in `cast_input/2` and `cast_stored/2` (`lib/ash/type/decimal.ex`) without checking that the resulting value is finite. Elixir\u0027s `Decimal` represents `Infinity` and `NaN` as valid structs, so a value such as `\\\"Infinity\\\"` or `\\\"NaN\\\"` passed casting and was persisted. Because `NaN` compares as false against every bound, `min` and `max` constraints do not reject it, and the stored special value later raises when used in `Decimal` arithmetic or is refused by the data layer, failing subsequent requests. The fix rejects any non-finite `Decimal` during casting.\\n\\nThis issue affects ash: from 1.28.0 before 3.32.2.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1284\", \"description\": \"CWE-1284 Improper Validation of Specified Quantity in Input\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"3.32.2\", \"versionStartIncluding\": \"1.28.0\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-09-01T03:17:15.389Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-82734\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-01T15:15:19.108Z\", \"dateReserved\": \"2026-08-31T00:59:10.001Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-09-01T03:17:15.389Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-82734

Vulnerability from fkie_nvd - Published: 2026-09-01 04:18 - Updated: 2026-09-01 21:15

Severity

2.1 (Low) - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-82734.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ash-project/ash/commit/818087b1b3364f2af6f5460d6b01262ad0f69204
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ash-project/ash/security/advisories/GHSA-mvvh-q33h-q62v
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-82734
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/ash-project/ash/security/advisories/GHSA-mvvh-q33h-q62v

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Ash.Type.Decimal\u0027"
          ],
          "packageName": "ash",
          "packageURL": "pkg:hex/ash",
          "product": "ash",
          "programFiles": [
            "lib/ash/type/decimal.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Ash.Type.Decimal\u0027:cast_input/2"
            },
            {
              "name": "\u0027Elixir.Ash.Type.Decimal\u0027:cast_stored/2"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "3.32.2",
              "status": "affected",
              "version": "1.28.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Ash.Type.Decimal\u0027"
          ],
          "packageName": "ash-project/ash",
          "packageURL": "pkg:github/ash-project/ash",
          "product": "ash",
          "programFiles": [
            "lib/ash/type/decimal.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Ash.Type.Decimal\u0027:cast_input/2"
            },
            {
              "name": "\u0027Elixir.Ash.Type.Decimal\u0027:cast_stored/2"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "818087b1b3364f2af6f5460d6b01262ad0f69204",
              "status": "affected",
              "version": "db6bdfcf1518c70d67975efb140cdeb2cb6a76e7",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value.\n\nAsh.Type.Decimal cast input through Ecto\u0027s decimal cast in cast_input/2 and cast_stored/2 (lib/ash/type/decimal.ex) without checking that the resulting value is finite. Elixir\u0027s Decimal represents Infinity and NaN as valid structs, so a value such as \"Infinity\" or \"NaN\" passed casting and was persisted. Because NaN compares as false against every bound, min and max constraints do not reject it, and the stored special value later raises when used in Decimal arithmetic or is refused by the data layer, failing subsequent requests. The fix rejects any non-finite Decimal during casting.\n\nThis issue affects ash: from 1.28.0 before 3.32.2."
    }
  ],
  "id": "CVE-2026-82734",
  "lastModified": "2026-09-01T21:15:00.147",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.1,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-82734",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-01T15:14:56.006491Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-01T04:18:02.600",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-82734.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ash-project/ash/commit/818087b1b3364f2af6f5460d6b01262ad0f69204"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ash-project/ash/security/advisories/GHSA-mvvh-q33h-q62v"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82734"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/ash-project/ash/security/advisories/GHSA-mvvh-q33h-q62v"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1284"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-82734 (GCVE-0-2026-82734)

FKIE_CVE-2026-82734

Tags

Sightings

Nomenclature