ash-project ash up to 3.32.1 Ash.Type.Union lib/ash/type/union.ex Ash.Type.Union.dump_to_native type confusion

Summaryinfo

A vulnerability categorized as critical has been discovered in ash-project ash up to 3.32.1. The affected element is the function Ash.Type.Union.dump_to_native of the file lib/ash/type/union.ex of the component Ash.Type.Union. The manipulation results in type confusion. This vulnerability is cataloged as CVE-2026-82741. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in ash-project ash up to 3.32.1. Affected is the function Ash.Type.Union.dump_to_native of the file lib/ash/type/union.ex of the component Ash.Type.Union. The manipulation with an unknown input leads to a type confusion vulnerability. CWE is classifying the issue as CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :map_with_tag, bypassing that member's validation and any tag-based authorization. For a union with storage: :map_with_tag, each member is identified in storage by a configured tag and tag_value. Ash.Type.Union.dump_to_native/2 (lib/ash/type/union.ex) did not force the configured tag when writing the value, so a tag carried in the submitted value was persisted verbatim. An attacker can therefore store a value whose data belongs to one member but whose tag names a different member. On read the value is re-selected by its tag and treated as the incompatible member (a type confusion), bypassing the real member's constraints and any logic or policy that branches on the union tag. The fix drops any incoming tag and forces the configured tag value on dump. This issue affects ash: from 2.14.18 before 3.32.2.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-82741 since 08/31/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available.

Upgrading to version 3.32.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash

Version

• 3.32.0
• 3.32.1

Website

• Product: https://github.com/ash-project/ash/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion