CVE-2026-82734

Name of the Vulnerable Software and Affected Versions ash versions 1.28.0 through 3.32.1

Description Improper validation of input quantities allows an attacker to submit non-finite decimal values, such as "Infinity" or "NaN" (Not a Number), which bypass numeric bounds constraints. This occurs because Ash.Type.Decimal uses Ecto's decimal cast in the cast input/2 and cast stored/2 functions without verifying if the resulting value is finite. Since NaN compares as false against all bounds, minimum and maximum constraints fail to reject it. Consequently, these special values are persisted and cause subsequent requests to fail when used in decimal arithmetic or when refused by the data layer.

Recommendations Update to version 3.32.2 or later.