CVE-2026-82752

Name of the Vulnerable Software and Affected Versions ash versions 0.10.0 through 3.32.9

Description Improper validation of input quantity allows an attacker to store values of arbitrary size in attributes that should be bounded by length constraints. The software uses Elixir's String.length/1 function to measure string length in Ash.Type.String (specifically within the apply constraints/2 function), Ash.Resource.Validation.StringLength, and the string length expression function. Because this method counts Unicode graphemes—which can contain an unbounded number of combining marks—a single grapheme can consist of megabytes of data while still satisfying a small max length constraint. When the underlying data layer (such as ETS, Mnesia, or Postgres text columns) does not impose its own independent limit, the entire value is persisted, potentially allowing an attacker to exhaust storage. Additionally, a discrepancy exists between the grapheme-based counting used by the application and the codepoint-based counting used by the storage layer, which may lead to data being rejected or truncated by the database column.

Recommendations Update ash to version 3.33.0 or later.