Executive brief
The Ash data library stores numeric vectors by encoding their dimension in a 16-bit field, which overflows when a vector exceeds 65,535 elements. An attacker can submit a malformed vector that corrupts the encoded header, causing the library to misparse the data and crash on any subsequent read attempt, denying access to affected records.
Technical details
An integer overflow vulnerability exists in Ash.Vector.new/1 (lib/ash/vector.ex), which encodes vectors as a binary header containing dimension and element count packed into a 16-bit unsigned integer without range validation. Vectors with more than 65,535 elements cause the dimension field to wrap modulo 65,536, creating a mismatch between the header and actual stored elements. The from_binary/1 function later reads binary-size(dim)-unit(32) using the wrapped header value, causing systematic misparsing and exceptions on every read of the corrupted record. The fix rejects any vector dimension exceeding 65,535. Attack requires submitting a crafted vector; no authentication bypass or network exploitation is required for applications using the library with untrusted input.
Affected products
- ash-project ash 2.14.13 to before 3.32.2
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Fix available in ash 3.32.2 and later