ash-project ash_double_entry up to 1.0.18 lib/ulid.ex decode/valid encoding error

Summaryinfo

A vulnerability labeled as problematic has been found in ash-project ash_double_entry up to 1.0.18. This affects the function decode/valid of the file lib/ulid.ex. Executing a manipulation can lead to encoding error. This vulnerability is tracked as CVE-2026-81638. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability classified as problematic was found in ash-project ash_double_entry up to 1.0.18. This vulnerability affects the function decode/valid of the file lib/ulid.ex. The manipulation with an unknown input leads to a encoding error vulnerability. The CWE definition for the vulnerability is CWE-172. The product does not properly encode or decode the data, resulting in unexpected values. As an impact it is known to affect integrity. CVE summarizes:

Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so canonical values are 0 to 7. decode/1 in lib/ulid.ex masks the first character to its low 3 bits and valid?/1 accepts all 32 characters in that position, so 0..., 8..., G... and R... decode to the identical 16-byte value and resolve to the same row. When the type is exposed as a public ID over an HTTP or API boundary, an attacker-supplied ID can be spelled differently from the record it actually reads or writes, desynchronizing or bypassing string-level checks such as idempotency and deduplication keys, deny-lists, audit correlation, or signatures computed over the submitted ID. This issue affects ash_double_entry: from 0.1.0 before 1.0.19.

The advisory is available at github.com. This vulnerability was named CVE-2026-81638 since 09/07/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit.

Upgrading to version 1.0.19 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash_double_entry

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16
• 1.0.17
• 1.0.18

Website

• Product: https://github.com/ash-project/ash_double_entry/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion