EUVD-2026-68945Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N reflects HTTP-facing Ash applications; AC:H because doubly-nested constrained attribute must exist in schema; no confidentiality or availability impact.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested {:array, {:array, type}} attribute, letting invalid input pass validation.
Ash.Type.apply_constraints/3 (lib/ash/type/type.ex) handled the {:array, {:array, type}} case by mapping only the inner {:array, type} constraints over each element, so constraints declared on the outer array (such as min_length, max_length, and nil_items?) were never applied. An attacker could submit an outer list that violates those constraints (too many elements, or nil entries where disallowed) and have it accepted and persisted. The fix enforces the outer array constraints and adds explicit handling for nil and non-list inputs.
This issue affects ash: from 2.16.1 before 3.32.2.
AnalysisAI
Outer array constraint bypass in ash-project Ash (versions 2.16.1 through <3.32.2) allows input that violates declared outer-array constraints on doubly-nested {:array, {:array, type}} attributes to be accepted and persisted without error. The defect in Ash.Type.apply_constraints/3 propagated only inner-array constraints during nested array validation, leaving outer constraints such as max_length, min_length, and nil_items? …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following to hold simultaneously: (1) the target Ash application defines at least one resource attribute using the {:array, {:array, type}} compound type; (2) that attribute declares outer-level constraint keywords - specifically max_length, min_length, nil_items?, or remove_nil_items? … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 2.1 accurately reflects the narrow blast radius: integrity impact is low (VI:L), with no confidentiality or availability consequence (VC:N, VA:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the ash dependency to version 3.32.2 or later, which contains the fix at commit c85ccff7dc6e3b0b3e40ad788b0056b3b6bee5ce (https://github.com/ash-project/ash/commit/c85ccff7dc6e3b0b3e40ad788b0056b3b6bee5ce). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in the ash crate before 0.33.1 for Rust. Rated critical severity (CVSS 9.8), this vulnerability
Private argument injection in the Ash Elixir framework (versions 3.0.0 through 3.29.2) allows end users to set action ar
Persistent record-level denial of service in the ash Elixir resource framework (versions 3.6.3-3.32.1) lets any actor wh
Integer overflow in Ash Framework's vector encoding corrupts stored vectors in any Elixir application using Ash versions
CPU exhaustion in Ash Framework's string type constraint handler allows denial of service against Elixir applications th
Memory exhaustion via decompression bomb in Ash Framework's keyset pagination can terminate Erlang nodes running version
Unbounded string storage in Ash Framework versions 0.10.0 through 3.32.x allows unauthenticated attackers to bypass max_
Memory exhaustion in Ash Framework's runtime filter engine allows an attacker controlling filter inputs to crash an Elix
Silent record overwrite in Ash's ETS and Mnesia data layers allows any actor who can supply a primary key on a create ac
Record-level authorization bypass in Ash (ash-project) versions 3.4.44 through 3.32.1 silently leaks denied records to a
Incorrect authorization in ash-project/ash (Elixir data framework) versions 3.13.2 through 3.32.1 causes relationship sc
Authorization policy bypass in Ash (Elixir framework) versions 3.29.0-3.32.1 permits any application actor to modify rec
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today