CVE-2026-82736: Ash Package Case-Insensitive String Constraint Bypass Vulnerability
Summary
CVE-2026-82736: Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Affects ash across 2 version ranges.
>= 1.29.0-rc0, < 3.32.2
>= f6f5d194bfc7802bd32e48bf2eabd2d97a0109a4, < d8320b0127c8ef453679d70e5dd23a9506951d21
Fixed in 3.32.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ash package is an open-source framework designed for building APIs and applications in Elixir. It provides a robust set of features for defining data types, managing relationships, and enforcing constraints on data. However, a vulnerability has been identified in the Ash.Type.CiString component, which handles case-insensitive string values. This vulnerability allows attackers to bypass length and match constraints, potentially leading to data integrity issues.
Vulnerability Detail
The vulnerability arises from an incorrect order of operations in the Ash.Type.CiString.apply_constraints/2 function. Specifically, the function validates string constraints such as max_length, min_length, and match patterns before case-folding the string. This means that an attacker can submit a string that appears valid in its original form but violates constraints when converted to its canonical form. For instance, a string that must match a specific uppercase pattern could be stored in a lowercased format, thus bypassing the validation checks. This flaw affects versions of Ash from 1.29.0-rc0 up to, but not including, 3.32.2.
How To Fix
Latest published version: 3.37.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.32.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually validate the string values before they are processed by the Ash framework to ensure they meet the required constraints. This can be done by implementing custom validation logic in your application.
Conclusion
The CVE-2026-82736 vulnerability in the Ash package poses a risk of constraint bypass for case-insensitive strings. It is crucial to update to the patched version 3.32.2 or later to mitigate this risk. Additionally, implementing custom validation can serve as a temporary workaround.
See every vulnerability recorded for ash →
FAQ
CVE-2026-82736 is a vulnerability in the Ash package that allows attackers to bypass string length and match constraints due to incorrect validation order.
Versions of Ash from 1.29.0-rc0 up to, but not including, 3.32.2 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 2.1, indicating a low severity level.
Implement custom validation logic to ensure that string values meet the required constraints before they are processed by the Ash framework.
Related vulnerabilities
Recent vulnerabilities recorded for ash.
