CVE-2026-82735: Ash Package Regex Denial of Service Vulnerability
Summary
CVE-2026-82735: Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service. Affects ash across 2 version ranges.
>= 0.10.0, < 3.32.2
>= 05848d5f4affe60fddd812222a18ada080c0813b, < 14928412a1a94a69c47df8e98920d3a2b09cdec4
Fixed in 3.32.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ash package is a powerful framework for building APIs in Elixir, designed to simplify the development of data-driven applications. It provides various types, including Ash.Type.String, which allows developers to define string attributes with constraints such as minimum and maximum lengths. However, a vulnerability was discovered that allows attackers to bypass these length constraints, leading to potential denial of service through excessive resource consumption.
Vulnerability Detail
The vulnerability arises from an uncontrolled resource consumption issue in the Ash.Type.String module. Specifically, the apply_constraints function evaluates the :match regex without first enforcing the min_length and max_length constraints. This oversight allows attackers to input excessively long strings that should have been rejected, causing the regex engine to perform extensive backtracking or linear evaluations, which can lead to significant CPU consumption and denial of service. The vulnerability affects versions of Ash from 0.10.0 to before 3.32.2.
How To Fix
Latest published version: 3.37.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.32.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as possible.
Conclusion
CVE-2026-82735 is a significant vulnerability in the Ash package that can lead to denial of service through regex evaluations on over-length input. It is essential to update to version 3.32.2 or later to protect your application from potential attacks. Utilizing tools like Vulert can help monitor and identify vulnerabilities in your software.
See every vulnerability recorded for ash →
FAQ
CVE-2026-82735 is a vulnerability in the Ash package that allows attackers to exploit regex evaluations on over-length input, potentially leading to denial of service.
If your application uses the affected versions of the Ash package, it may be susceptible to denial of service attacks due to excessive CPU consumption from regex evaluations.
The vulnerability affects Ash versions from 0.10.0 to before 3.32.2.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version to mitigate the risk of denial of service.
Related vulnerabilities
Recent vulnerabilities recorded for ash.
