ash-project ash

• CVE-2026-96581 High 7.6 An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records 0.3%
• CVE-2026-114214 Medium 6.0 Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records 0.2%
• CVE-2026-101028 Medium 6.0 Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts 0.3%
• CVE-2026-94201 High 8.2 Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash 0.3%
• CVE-2026-93477 Medium 5.9 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash 0.2%
• CVE-2026-86338 Medium 6.0 Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle 0.4%
• CVE-2026-82752 Medium 5.9 Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length 0.2%
• CVE-2026-82747 Medium 5.9 Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor 0.2%
• CVE-2026-82749 Medium 5.9 Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records 0.2%
• CVE-2026-82748 Low 2.1 Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another 0.2%
• CVE-2026-82746 Medium 5.9 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records 0.2%
• CVE-2026-82745 Medium 5.9 ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness 0.2%
• CVE-2026-82744 Low 2.1 Ash.Reactor change step fails open, skipping a change when its where guard raises 0.2%
• CVE-2026-82743 Low 2.1 Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads 0.2%
• CVE-2026-82742 Medium 5.9 Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory 0.2%
• CVE-2026-82741 Low 2.1 Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion 0.2%
• CVE-2026-82740 Low 2.1 Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs 0.2%
• CVE-2026-82739 Low 2.1 Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error 0.2%
• CVE-2026-82738 Medium 5.9 Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service 0.2%
• CVE-2026-82737 Medium 5.9 Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads 0.2%
• CVE-2026-82736 Low 2.1 Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass 0.2%
• CVE-2026-82735 Medium 5.9 Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service 0.2%
• CVE-2026-82734 Low 2.1 Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal 0.2%
• CVE-2026-67579 High 7.5 Filter expression injection via forged keyset pagination cursor in Ash 0.6%
• CVE-2026-70395 Low 2.1 Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash 0.2%
• CVE-2026-69659 Medium 5.9 Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset 0.4%
• CVE-2026-55736 Medium 5.9 Private action arguments can be set by user input in Ash 0.2%
• CVE-2026-34593 High 8.2 Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash 0.4%
• CVE-2025-48044 High 8.6 Authorization bypass when bypass policy condition evaluates to true 0.7%
• CVE-2025-48043 High 8.6 Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization 0.4%
• CVE-2025-48042 High 7.1 Before action hooks may execute in certain scenarios despite a request being forbidden 0.3%