Ash Double Entry
Monthly
ULID first-character non-canonicality in ash_double_entry (Elixir) exposes a multi-spelling identifier aliasing flaw affecting versions 0.1.0 through 1.0.18. The AshDoubleEntry.ULID type encodes 128-bit identifiers as 26 Crockford base-32 characters, but the first character carries only 3 usable bits - canonical values are 0 through 7 - while the library's decode and validation functions accepted all 32 possible characters there, allowing 8, G, and R to silently decode to the identical 16-byte value as their canonical counterpart. An attacker who can submit caller-controlled ULIDs over an HTTP or API boundary can exploit this to circumvent application-layer string comparisons such as idempotency keys, deduplication guards, deny-list lookups, or audit-trail correlation, causing the server to resolve the intended record while treating the alternate spelling as a distinct key. No public exploit has been identified at time of analysis.
ULID first-character non-canonicality in ash_double_entry (Elixir) exposes a multi-spelling identifier aliasing flaw affecting versions 0.1.0 through 1.0.18. The AshDoubleEntry.ULID type encodes 128-bit identifiers as 26 Crockford base-32 characters, but the first character carries only 3 usable bits - canonical values are 0 through 7 - while the library's decode and validation functions accepted all 32 possible characters there, allowing 8, G, and R to silently decode to the identical 16-byte value as their canonical counterpart. An attacker who can submit caller-controlled ULIDs over an HTTP or API boundary can exploit this to circumvent application-layer string comparisons such as idempotency keys, deduplication guards, deny-list lookups, or audit-trail correlation, causing the server to resolve the intended record while treating the alternate spelling as a distinct key. No public exploit has been identified at time of analysis.