Executive brief
Ash is a data-driven development framework used to build robust applications. A vulnerability in string validation allows attackers to bypass length constraints and force expensive regular expression evaluation on oversized inputs, consuming CPU resources and potentially causing denial of service.
Technical details
The vulnerability is an uncontrolled resource consumption (ReDoS / regex DoS) in Ash.Type.String.apply_constraints/2 (lib/ash/type/string.ex). The vulnerable component evaluates the :match regex pattern regardless of min_length and max_length constraints. Because the length check does not gate the regex evaluation, an input exceeding the length limit still has the pattern applied, allowing catastrophic backtracking on attacker-controlled input or linear-time regex evaluation on arbitrarily large payloads. The fix skips regex matching when length constraints are violated. No authentication is required; the vulnerability is triggered by sending oversized input to a string field with both length and match constraints. The fix is available in version 3.32.2 and later.
Affected products
- ash-project ash 0.10.0 to before 3.32.2
Timeline
- 2026-09-01: disclosed: CVE-2026-82735 published
- 2026: patched: Fix available in ash 3.32.2