CVE-2026-82734
Received Received - Intake

Improper Input Validation in Ash Framework

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value. Ash.Type.Decimal cast input through Ecto's decimal cast in cast_input/2 and cast_stored/2 (lib/ash/type/decimal.ex) without checking that the resulting value is finite. Elixir's Decimal represents Infinity and NaN as valid structs, so a value such as "Infinity" or "NaN" passed casting and was persisted. Because NaN compares as false against every bound, min and max constraints do not reject it, and the stored special value later raises when used in Decimal arithmetic or is refused by the data layer, failing subsequent requests. The fix rejects any non-finite Decimal during casting. This issue affects ash: from 1.28.0 before 3.32.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-82734
EUVD
EUVD-2026-68960

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash From 1.28.0 (inc) to 3.32.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows attackers to submit non-finite decimal values like Infinity or NaN through the Ash framework's decimal input handling. These values bypass numeric constraints such as min/max because NaN comparisons always return false. The values are then stored and later cause failures during arithmetic operations or data layer interactions.

Detection Guidance

Check Ash framework versions between 1.28.0 and 3.32.1. Look for applications using Ash.Type.Decimal with non-finite inputs like Infinity, -Inf, or NaN bypassing constraints. Review logs for Decimal arithmetic failures or unhandled exceptions during data operations.

Impact Analysis

It may allow invalid data to be accepted and stored, potentially causing application crashes or incorrect behavior when processing decimal fields. Systems relying on numeric constraints could be tricked into accepting out-of-bounds values, leading to data integrity issues or unexpected failures.

Mitigation Strategies

Upgrade Ash framework to version 3.32.2 or later. Review input validation for decimal fields to reject non-finite values. Update Ecto.Type.cast usage to ensure proper validation. Test systems for existing invalid decimal values and handle them appropriately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82734. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart