ash-project ash up to 3.32.1 CiString ci_string.ex Ash.Type.CiString.apply_constraints behavioral workflow

Summaryinfo

A vulnerability has been found in ash-project ash up to 3.32.1 and classified as problematic. Affected by this issue is the function Ash.Type.CiString.apply_constraints of the file lib/ash/type/ci_string.ex of the component CiString. This manipulation causes behavioral workflow. The identification of this vulnerability is CVE-2026-82736. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in ash-project ash up to 3.32.1. It has been declared as problematic. Affected by this vulnerability is the function Ash.Type.CiString.apply_constraints of the file lib/ash/type/ci_string.ex of the component CiString. The manipulation with an unknown input leads to a behavioral workflow vulnerability. The CWE definition for the vulnerability is CWE-841. The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence. As an impact it is known to affect integrity. The summary by CVE is:

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.apply_constraints/2 (lib/ash/type/ci_string.ex) validated the max_length, min_length, and match constraints against the value as submitted, while the type case-folds the string (per its casing) for storage and comparison. Because validation ran before folding, an attacker can submit a value whose folded form breaks a constraint but whose original form passes: for example, against a match pattern requiring uppercase, an uppercase value that is stored lowercased persists a value the pattern rejects. The fix case-folds the value at the start of apply_constraints/2, so the constraints are checked against the form that is actually stored. This issue affects ash: from 1.29.0-rc0 before 3.32.2.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-82736 since 08/31/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.32.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash

Version

• 3.32.0
• 3.32.1

Website

• Product: https://github.com/ash-project/ash/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion