PT-2026-84087 · Ash · Ash
CVSS v4.0
5.9
Medium
| Vector | AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
ash versions 3.6.3 through 3.32.1
Description
Improper input validation allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an
Ash.Type.UUIDv7 attribute. The function Ash.Type.UUIDv7.cast input/2 accepts any well-formed UUID string and stores it as a 16-byte binary. During the read process, the cast stored/2 function routes the stored binary back through cast input/2. Because validation was tightened, the system only matches version-7 (and optionally version-4) 16-byte binaries or 36-character strings. A stored non-v7 16-byte binary matches neither, resulting in an error that causes all subsequent reads of that record to fail, effectively poisoning the row permanently.Recommendations
Update ash to version 3.32.2 or later.
Exploit
Fix
DoS
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ash