Vulnerability · Published Sep 1, 2026 · Assigned by EEF
CVE-2026-82735Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service
Medium 5.9
In plain English
A medium-severity uncontrolled resource consumption in ash from ash-project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Official description
Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.apply_constraints/2 (lib/ash/type/string.ex) evaluated the :match regex regardless of the min_length and max_length constraints on the same attribute. Because the length check did not gate the regex, an over-length value that the length constraint rejects still had the pattern applied to it, so the length limit that would otherwise bound the work never constrained the regex input. Against a backtracking pattern this yields catastrophic regex evaluation on attacker-sized input, and even a linear pattern runs on arbitrarily large input, consuming CPU per request. The fix skips the :match regex whenever a length constraint is violated, making the two checks order-independent. This issue affects ash: from 0.10.0 before 3.32.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ash-project | ash | 0.10.0 – before 3.32.2 |
| ash-project | ash | 05848d5f4affe60fddd812222a18ada080c0813b – before 14928412a1a94a69c47df8e98920d3a2b09cdec4 |
Weakness: CWE-400 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N