Executive brief
Ash is a framework for building data-driven applications. An attacker can submit special decimal values like "Infinity" or "NaN" that bypass validation constraints, potentially causing the application to fail when performing arithmetic operations or persisting data to the database.
Technical details
Ash.Type.Decimal casts input through Ecto's decimal cast in cast_input/2 and cast_stored/2 without validating that the resulting Decimal is finite. Elixir's Decimal module treats Infinity and NaN as valid struct values. Because NaN compares as false against all numeric comparisons, min/max constraints fail to reject it, allowing non-finite values to persist. These special values later cause failures in downstream Decimal arithmetic operations or are rejected by the database layer. The vulnerability requires only the ability to submit input to a decimal field; the fix validates that all cast Decimal values are finite.
Affected products
- ash-project ash 1.28.0 before 3.32.2
Timeline
- 2026-09-01: disclosed