ash-project ash_phoenix up to 2.3.24 Helpers AshPhoenix.Helpers.get_subdomain host incorrect regex

Summaryinfo

A vulnerability marked as critical has been reported in ash-project ash_phoenix up to 2.3.24. This impacts the function AshPhoenix.Helpers.get_subdomain of the component Helpers. This manipulation of the argument host causes incorrect regex. The identification of this vulnerability is CVE-2026-82726. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in ash-project ash_phoenix up to 2.3.24 and classified as critical. Affected by this vulnerability is the function AshPhoenix.Helpers.get_subdomain of the component Helpers. The manipulation of the argument host with an unknown input leads to a incorrect regex vulnerability. The CWE definition for the vulnerability is CWE-185. The product specifies a regular expression in a way that causes data to be improperly matched or compared. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.get_subdomain/2 stripped the root domain with String.replace(host, ~r/.?#{root_host}/, ""). The root host was interpolated raw, so each . became a wildcard and any metacharacter a pattern, and the replace was global and unanchored, so a match was removed from anywhere in the string. With root_host example.com, Host: foo.exampleXcom.attacker.net returned the tenant foo.attacker.net. A metacharacter-bearing or nil root host degraded the pattern or raised on every request. The comparison was also case-sensitive, so TENANT.EXAMPLE.COM and EXAMPLE.COM slipped past the root-host allowlist. conn.host comes from the client Host header. The fix matches the root host case-insensitively and only as an exact trailing suffix. This issue affects ash_phoenix: from 2.1.26 before 2.3.25.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-82726 since 08/31/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.3.25 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash_phoenix

Version

• 2.3.0
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 2.3.8
• 2.3.9
• 2.3.10
• 2.3.11
• 2.3.12
• 2.3.13
• 2.3.14
• 2.3.15
• 2.3.16
• 2.3.17
• 2.3.18
• 2.3.19
• 2.3.20
• 2.3.21
• 2.3.22
• 2.3.23
• 2.3.24

Website

• Product: https://github.com/ash-project/ash_phoenix/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion