EUVD-2026-68963Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation requires non-default co-configuration of casing and a constraint on the same CiString attribute; AV:N because Ash applications typically expose CiString fields through network-accessible APIs.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints.
Ash.Type.CiString.apply_constraints/2 (lib/ash/type/ci_string.ex) validated the max_length, min_length, and match constraints against the value as submitted, while the type case-folds the string (per its casing) for storage and comparison. Because validation ran before folding, an attacker can submit a value whose folded form breaks a constraint but whose original form passes: for example, against a match pattern requiring uppercase, an uppercase value that is stored lowercased persists a value the pattern rejects. The fix case-folds the value at the start of apply_constraints/2, so the constraints are checked against the form that is actually stored.
This issue affects ash: from 1.29.0-rc0 before 3.32.2.
AnalysisAI
Constraint bypass in Ash Framework's CiString type allows storing string values that violate configured length or match constraints after case-folding. Any application built on ash versions 1.29.0-rc0 through 3.32.2 that defines a CiString attribute with both a casing option (:lower or :upper) and a max_length, min_length, or match constraint is affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target application must use Ash.Type.CiString (ash 1.29.0-rc0 through 3.32.1) with both a casing option (constraints: [casing: :lower] or [casing: :upper]) and at least one of max_length, min_length, or match declared on the same attribute - this co-configuration is non-default and must be intentionally authored in the resource schema. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.1 is credible and well-supported by the impact profile: the only consequence is a low-integrity violation (VI:L) with no confidentiality or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the ash dependency to version 3.32.2 or later by updating mix.exs to {:ash, "~> 3.32.2"} and running mix deps.update ash; the fix is contained in commit d8320b0127c8ef453679d70e5dd23a9506951d21 (https://github.com/ash-project/ash/commit/d8320b0127c8ef453679d70e5dd23a9506951d21). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in the ash crate before 0.33.1 for Rust. Rated critical severity (CVSS 9.8), this vulnerability
Private argument injection in the Ash Elixir framework (versions 3.0.0 through 3.29.2) allows end users to set action ar
Persistent record-level denial of service in the ash Elixir resource framework (versions 3.6.3-3.32.1) lets any actor wh
Integer overflow in Ash Framework's vector encoding corrupts stored vectors in any Elixir application using Ash versions
CPU exhaustion in Ash Framework's string type constraint handler allows denial of service against Elixir applications th
Memory exhaustion via decompression bomb in Ash Framework's keyset pagination can terminate Erlang nodes running version
Unbounded string storage in Ash Framework versions 0.10.0 through 3.32.x allows unauthenticated attackers to bypass max_
Memory exhaustion in Ash Framework's runtime filter engine allows an attacker controlling filter inputs to crash an Elix
Silent record overwrite in Ash's ETS and Mnesia data layers allows any actor who can supply a primary key on a create ac
Record-level authorization bypass in Ash (ash-project) versions 3.4.44 through 3.32.1 silently leaks denied records to a
Incorrect authorization in ash-project/ash (Elixir data framework) versions 3.13.2 through 3.32.1 causes relationship sc
Authorization policy bypass in Ash (Elixir framework) versions 3.29.0-3.32.1 permits any application actor to modify rec
Share
External POC / Exploit Code
Leaving vuln.today