CVE-2026-82735

Name of the Vulnerable Software and Affected Versions ash versions 0.10.0 through 3.32.1

Description An uncontrolled resource consumption issue exists where an attacker can force the execution of an expensive regular expression on input that should have been rejected by a length constraint. The function Ash.Type.String.apply constraints/2 evaluates the :match regex regardless of the min length and max length constraints on the same attribute. Since the length check does not gate the regex, values exceeding the length limit still have the pattern applied, leading to catastrophic regex evaluation with backtracking patterns or high CPU consumption with linear patterns on arbitrarily large input.

Recommendations Update ash to version 3.32.2 or later.