EEF-CVE-2026-82736 Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass

Summary Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.applyconstraints/2 lib/ash/type/cistring.ex validated the maxlength, minlength, a...

EUVD-2026-68963

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.applyconstraints/2 lib/ash/type/cistring.ex validated the maxlength, minlength, and match...

CVE-2026-82736 Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.applyconstraints/2 lib/ash/type/cistring.ex validated the maxlength, minlength, and match...

EUVD-2026-68962

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

CVE-2026-82735 Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

EEF-CVE-2026-82735 Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

Summary Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex...

CVE-2026-82735 Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

CVE-2026-82734

CVE-2026-82734 affects ash-project ash (Elixir), versions 1.28.0 through 3.32.1 . The vulnerability is in Ash.Type.Decimal (lib/ash/type/decimal.ex), which casts input via Ecto's decimal cast without verifying the result is finite. Because Elixir's Decimal module treats Infinity and NaN as valid ...

CVE-2026-82732

Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...

CVE-2026-82732

ash_typescript (versions 0.15.0 through before 0.18.0) contains an improper input validation flaw in AshTypescript.TypedController.RequestHandler. The handler calls Ash.Type.cast_input/3 to coerce input but never invokes Ash.Type.apply_constraints/3, rendering declared constraints (one_of, max_le...

EUVD-2026-68927

Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...

CVE-2026-82732 Declared argument constraints not enforced on AshTypescript typed controller routes

Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...

CVE-2026-82732 Declared argument constraints not enforced on AshTypescript typed controller routes

Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...

PT-2026-84085

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.apply constraints/2 lib/ash/type/ci string.ex validated the max length, min length, and...

PT-2026-84084

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.apply constraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

RHEL 9 : runc (RHSA-2026:61907)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:61907 advisory. The runC tool is a lightweight, portable implementation of the Open Container Format OCF that provides container runtime. Security Fixes:...

CVE-2026-66422

A flaw was found in Apache Tomcat. This improper authorization vulnerability occurs because security-role-ref definitions are incorrectly used as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole. This misconfiguration allows for a bypass of declarative...

CVE-2026-65182

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

CVE-2026-19616

CVE-2026-19616 is a Missing Authorization vulnerability in TBC Technology Inc. KitLogistic prior to v2.2.2 . The flaw allows an attacker to access functionality not properly constrained by ACLs , meaning unauthorized network-based access to restricted features is possible without credentials or u...

crypto/x509: Incorrect enforcement of email constraints in crypto/x509

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...