CVE-2026-81638

Received Received - Intake

Improper Encoding Handling in ash_double_entry

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: EEF

Description

Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so canonical values are 0 to 7. decode/1 in lib/ulid.ex masks the first character to its low 3 bits and valid?/1 accepts all 32 characters in that position, so 0..., 8..., G... and R... decode to the identical 16-byte value and resolve to the same row. When the type is exposed as a public ID over an HTTP or API boundary, an attacker-supplied ID can be spelled differently from the record it actually reads or writes, desynchronizing or bypassing string-level checks such as idempotency and deduplication keys, deny-lists, audit correlation, or signatures computed over the submitted ID. This issue affects ash_double_entry: from 0.1.0 before 1.0.19.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-07

Generated

2026-09-08

AI Q&A

2026-09-08

EPSS Evaluated

N/A

NVD

CVE-2026-81638

Affected Vendors & Products

Vendor	Product	Version / Range
ash-project	ash_double_entry	From 0.1.0 (inc) to 1.0.19 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-173	The product does not properly handle when an input uses an alternate encoding that is valid for the control sphere to which the input is being sent.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper handling of alternate encoding in the ash_double_entry library. It allows an attacker to submit different string representations of the same identifier, which decode to the same value. This can cause desynchronization or bypass of string-level checks like idempotency keys or audit trails.

Detection Guidance

This vulnerability is specific to the ash_double_entry library and involves improper handling of ULID encoding. Detection requires checking if your system uses affected versions of ash_double_entry (0.1.0 to 1.0.19). Inspect dependency files like mix.exs for Elixir projects or package.json for JavaScript projects to identify the library version.

Impact Analysis

An attacker could exploit this to bypass security checks, manipulate data, or disrupt operations by submitting alternate encodings of identifiers. This might lead to unauthorized access, data corruption, or incorrect audit logs if the system relies on string-level validation.

Compliance Impact

This vulnerability could undermine compliance by allowing unauthorized data access or manipulation, which may violate integrity and audit requirements in GDPR or HIPAA. String-level checks for idempotency or deduplication could fail, leading to non-compliance with data protection and security controls.

Mitigation Strategies

Upgrade ash_double_entry to version 1.0.19 or later to address the vulnerability. If upgrading is not immediately possible, review all public ID fields exposed via HTTP or API boundaries to ensure they are not used for critical operations like idempotency, deduplication, or audit correlation.

Hi! I’m here to help you understand CVE-2026-81638. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70