Executive brief
Ash is a framework used to build data layer abstractions in Elixir applications. A flaw in the UUIDv7 data type allows an attacker with write access to inject a malformed UUID that permanently breaks read operations on that record, causing data to become inaccessible and blocking normal application functionality.
Technical details
The vulnerability is an improper input validation issue in Ash.Type.UUIDv7. The cast_input/2 function accepts any well-formed UUID string (including non-v7 UUIDs) and stores it as 16-byte binary. However, cast_stored/2 attempts to re-validate this binary on read by routing it back through cast_input/2, which after v3.6.3 only accepts version-7 (and optionally version-4) UUIDs in binary form. A stored non-v7 binary matches neither the binary nor string clause, causing cast_stored/2 to return :error on every subsequent read. An attacker with write privileges can poison a record by injecting such a UUID, permanently denying read access. The fix decodes 16-byte stored binaries directly without re-validation.
Affected products
- ash-project ash 3.6.3 to 3.32.1
Timeline
- 2026-09-01: disclosed