CVE-2026-82740

Name of the Vulnerable Software and Affected Versions ash versions 2.16.1 through 3.32.1

Description Improper input validation occurs when the software fails to enforce outer array constraints on a doubly-nested {:array, {:array, type}} attribute. The apply constraints/3 function in lib/ash/type/type.ex only mapped inner array constraints over each element, ignoring constraints defined for the outer array such as min length, max length, and nil items?. This allows an attacker to submit an outer list that violates these constraints, such as containing too many elements or disallowed nil entries, which are then accepted and persisted.

Recommendations Update ash to version 3.32.2.