EUVD-2026-68949

Not Failing Securely Failing Open vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep...

EEF-CVE-2026-82743 Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads

Summary Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actions.Read.AsyncLimiter.awaitatleastone/1 lib/ash/actions/read/asynclimiter.ex waited for concurrent async read task...

EUVD-2026-68948

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actions.Read.AsyncLimiter.awaitatleastone/1 lib/ash/actions/read/asynclimiter.ex waited for concurrent async read tasks by...

CVE-2026-82743

ash-project ash (Elixir framework) contains an uncontrolled resource consumption vulnerability in Ash.Actions.Read.AsyncLimiter.await_at_least_one/1. The function polled outstanding async read tasks with Task.yield(task, 0) in a tight loop rather than blocking, causing a BEAM scheduler to spin at...

CVE-2026-82743 Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actions.Read.AsyncLimiter.awaitatleastone/1 lib/ash/actions/read/asynclimiter.ex waited for concurrent async read tasks by...

CVE-2026-82743 Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actions.Read.AsyncLimiter.awaitatleastone/1 lib/ash/actions/read/asynclimiter.ex waited for concurrent async read tasks by...

EUVD-2026-68947

Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its...

CVE-2026-82742

CVE-2026-82742 is an uncontrolled resource consumption vulnerability in the ash Elixir framework (versions 1.29.0-rc0 through before 3.32.2 ). The root cause is in Ash.Filter.Runtime's flatten_relationships/2 function (lib/ash/filter/runtime.ex), which eagerly materializes the full Cartesian prod...

EEF-CVE-2026-82742 Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory

Summary Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations...

CVE-2026-82742 Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory

Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its...

CVE-2026-82742 Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory

Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its...

CVE-2026-82741 Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion

Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :mapwithtag, bypassing that member's validation and any tag-based authorization. For a union with storage: :mapwithtag, each...

CVE-2026-82741 Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion

Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :mapwithtag, bypassing that member's validation and any tag-based authorization. For a union with storage: :mapwithtag, each...

EUVD-2026-68946

Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :mapwithtag, bypassing that member's validation and any tag-based authorization. For a union with storage: :mapwithtag, each...

EEF-CVE-2026-82741 Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion

Summary Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :mapwithtag, bypassing that member's validation and any tag-based authorization. For a union with storage: :mapwithtag...

CVE-2026-82741

CVE-2026-82741 affects the ash-project ash Elixir framework (versions 2.14.18 through before 3.32.2 ). The vulnerability is in Ash.Type.Union.dump_to_native/2 (lib/ash/type/union.ex), which did not force the configured tag when writing values with storage: :map_with_tag. An attacker can submit a ...

CVE-2026-82740 Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs

Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested :array, :array, type attribute, letting invalid input pass validation. Ash.Type.applyconstraints/3 lib/ash/type/type.ex handled the :array, :array, type case by mapping only...

EUVD-2026-68945

Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested :array, :array, type attribute, letting invalid input pass validation. Ash.Type.applyconstraints/3 lib/ash/type/type.ex handled the :array, :array, type case by mapping only...

EEF-CVE-2026-82740 Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs

Summary Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested :array, :array, type attribute, letting invalid input pass validation. Ash.Type.applyconstraints/3 lib/ash/type/type.ex handled the :array, :array, type case by mappi...

CVE-2026-82740

ash-project ash (versions 2.16.1 through before 3.32.2 ) contains an improper input validation flaw in Ash.Type.apply_constraints/3 (lib/ash/type/type.ex). When handling a doubly-nested {:array, {:array, type}} attribute, only the inner array constraints were mapped over each element, so outer ar...