Ash Framework CVE-2026-82735

The vulnerable code path is reached only when an Ash resource attribute is configured with both a :match regex constraint and at least one of :min_length or :max_length length constraints on the same attribute - this combined configuration is the necessary prerequisite. The attacker must be able to supply an arbitrary-length string value to that attribute via whatever interface the application exposes (Phoenix controller, GraphQL mutation, JSON:API endpoint, or similar). Exploitation is most severe against backtracking regex patterns where input length produces exponential evaluation time, but any regex pattern on an over-length string imposes linear CPU cost per request. Limiting factors: the application must run Ash versions between 0.10.0 and 3.32.2; the specific targeted attribute must have both constraint types defined together; and the endpoint accepting that input must be reachable by the attacker, with any authentication requirements determined by the application's own access control rather than by Ash itself.

The provided CVSS 4.0 vector (5.9, AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) contains an AV:L (Local) designation that conflicts with the described attack model: in a typical Ash deployment within a Phoenix web application, string input arrives via HTTP requests, making the effective attack vector network-accessible for most production deployments. This discrepancy likely understates real-world exposure and should be verified with the Erlang Ecosystem Foundation CNA. The AT:P qualifier (specific attack conditions required) accurately reflects that the vulnerable code path is only reached when an Ash attribute defines both a :match regex and a length constraint - a common but not universal pattern. Availability impact rated High (VA:H) is consistent with the ability to exhaust a BEAM scheduler thread per request. No EPSS data is provided and this CVE is not listed in CISA KEV, indicating no confirmed active exploitation. No public proof-of-concept code is identified at time of analysis. Despite the moderate score, real-world risk is meaningful for network-exposed Ash applications: the attack is low-complexity once an affected attribute endpoint is identified, and concurrent requests can saturate the BEAM scheduler, halting legitimate request processing.

An attacker targeting a Phoenix web application backed by Ash identifies an API parameter or form field that maps to an Ash string attribute configured with both a :max_length constraint and a backtracking-capable :match regex (such as an email validation or slug pattern). The attacker sends repeated HTTP requests containing strings far exceeding the max_length - on unpatched versions, each request drives the BEAM regex engine into catastrophic backtracking on the oversized input, consuming one scheduler thread for the duration of evaluation. Sending a modest volume of such requests concurrently saturates available BEAM scheduler threads and causes the application to stop serving legitimate traffic. No public exploit code has been identified at time of analysis.