Executive brief
Ash is a data layer abstraction framework for Elixir applications used to manage data models and constraints. An attacker can circumvent string length limits by crafting payloads with Unicode combining marks, allowing unbounded storage of data in attributes that should be restricted to small sizes. This could lead to denial-of-service through resource exhaustion or enable attackers to store malicious content beyond intended limits.
Technical details
The vulnerability lies in the string length validation logic in Ash.Type.String, which uses Elixir's String.length/1 function that counts Unicode graphemes rather than codepoints or bytes. A single grapheme can contain an arbitrary number of combining diacritical marks (e.g., a base character followed by a million combining acute accents), allowing an attacker to satisfy a max_length constraint while storing megabytes of data. The storage layer (ETS, Mnesia, or untyped text columns) does not enforce independent size limits and will persist the entire value. The mismatch between grapheme-based validation and codepoint-based storage also creates potential for truncation or rejection at the data layer. No patch availability information is provided in the advisory.
Affected products
- ash-project ash 0.10.0 to before 3.33.0
Timeline
- 2026-09-05: published