CVE-2026-82736
Received Received - Intake

Incorrect Behavior Order in Ash Framework Allows Constraint Bypass

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.apply_constraints/2 (lib/ash/type/ci_string.ex) validated the max_length, min_length, and match constraints against the value as submitted, while the type case-folds the string (per its casing) for storage and comparison. Because validation ran before folding, an attacker can submit a value whose folded form breaks a constraint but whose original form passes: for example, against a match pattern requiring uppercase, an uppercase value that is stored lowercased persists a value the pattern rejects. The fix case-folds the value at the start of apply_constraints/2, so the constraints are checked against the form that is actually stored. This issue affects ash: from 1.29.0-rc0 before 3.32.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-82736
EUVD
EUVD-2026-68963

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash From 1.29.0-rc0 (inc) to 3.32.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-180 The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves incorrect validation order in the Ash framework's CiString type. The system validates input constraints like length or pattern matching before applying case folding (converting to lowercase or uppercase). This allows attackers to submit values that pass validation in their original form but violate constraints after case folding during storage. For example, an uppercase string matching a pattern could be stored in lowercase, persisting a value that the pattern would reject.

Detection Guidance

To detect this vulnerability, check if your Ash framework version is between 1.29.0-rc0 and 3.32.2. Run: grep -r "ash" mix.exs | grep version or mix deps | grep ash. Inspect applications using :ci_string attributes with casing, max_length, or match constraints for improper validation.

Impact Analysis

This vulnerability could allow attackers to bypass declared constraints such as maximum length or pattern matching rules. This may lead to database overflow, silent data truncation, or downstream integrity issues. For instance, a string that passes validation but exceeds length limits after case folding could corrupt data storage or processing.

Mitigation Strategies

Upgrade Ash to version 3.32.2 or later. Apply the patch from commit d8320b0127c8ef453679d70e5dd23a9506951d21. Review and update any :ci_string attributes to ensure constraints are validated after case folding.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82736. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart