CVE-2026-82740

Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested :array, :array, type attribute, letting invalid input pass validation. Ash.Type.applyconstraints/3 lib/ash/type/type.ex handled the :array, :array, type case by mapping only...

CVE-2026-82740

ash-project ash (versions 2.16.1 through before 3.32.2 ) contains an improper input validation flaw in Ash.Type.apply_constraints/3 (lib/ash/type/type.ex). When handling a doubly-nested {:array, {:array, type}} attribute, only the inner array constraints were mapped over each element, so outer ar...