CVE-2026-82752
Received Received - Intake

Improper Input Validation in Ash Framework

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: EEF

Description
Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it. Ash measures string length with Elixir's String.length/1, which counts Unicode graphemes, in the max_length and min_length constraints of Ash.Type.String (apply_constraints/2 in lib/ash/type/string.ex), in Ash.Resource.Validation.StringLength, and in the string_length expression function. A grapheme carries an unbounded number of combining marks, so a base character followed by a million combining acute accents is one grapheme and megabytes of data, and satisfies max_length: 2. Where the data layer imposes no independent limit (ETS, Mnesia, or a Postgres text column) the whole value is persisted, so an attacker can write an entire request body into an attribute declared with a small maximum and grow storage without bound. The counting unit also disagrees with the storage layer, which counts codepoints rather than graphemes, so a value accepted by the constraint can still be rejected or truncated by the column. A Postgres varchar(n) column bounds the value itself and is not exposed. This issue affects ash: from 0.10.0 before 3.33.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-82752
EUVD
EUVD-2026-72014

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ash-project ash to 3.33.0 (exc)
ash-project ash From 3.33.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper validation of string length in the Ash framework. It occurs because Ash counts Unicode graphemes instead of codepoints or bytes when enforcing max_length constraints. Attackers can exploit this by creating a single grapheme with a base character followed by many combining marks, bypassing length limits and storing megabytes of data in attributes declared with small max_length values.

Detection Guidance

Check Ash framework versions between 0.10.0 and 3.32.0 for potential exposure. Inspect string attributes with max_length constraints for unusually large values. Use Elixir commands like String.length/1 to verify grapheme counting behavior in validations.

Impact Analysis

This flaw can lead to excessive storage consumption as attackers store oversized values in constrained attributes. It may also cause data integrity issues since stored values could be truncated by storage layers like Postgres, which count codepoints rather than graphemes. Systems using Ash versions 0.10.0 to 3.32.0 are vulnerable.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to potential data integrity and availability issues. It allows unbounded storage growth by bypassing length constraints, risking unauthorized data retention or loss. Storage layers may truncate data, violating integrity requirements. GDPR requires data minimization and secure storage, while HIPAA mandates integrity controls; this flaw undermines both.

Mitigation Strategies

Upgrade Ash framework to version 3.33.0 or later. Configure default_string_length_count to :codepoints in Ash settings. Review string attributes with max_length constraints and validate storage layers enforce size limits.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82752. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart