CVE-2026-82740: Ash Package Improper Input Validation in Nested Array Constraints
Summary
CVE-2026-82740: Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs. Affects ash across 2 version ranges.
>= 2.16.1, < 3.32.2
>= 7b50a401d85018371659e51c34c89d7e1d0c2ac9, < c85ccff7dc6e3b0b3e40ad788b0056b3b6bee5ce
Fixed in 3.32.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ash package is an open-source framework designed for building APIs and data-driven applications in Elixir. It provides a robust set of features for defining data types, relationships, and validations. However, it has been found to have a vulnerability that allows improper input validation for nested array attributes, potentially leading to data integrity issues.
Vulnerability Detail
The vulnerability arises from Ash.Type's failure to enforce outer array constraints on nested array inputs defined as {:array, {:array, type}}. This oversight allows attackers to submit invalid outer lists that violate constraints such as min_length, max_length, and nil_items?, which could result in the acceptance and persistence of malformed data. The issue is rooted in the way Ash.Type.apply_constraints/3 processes these nested structures, only applying inner constraints without validating the outer array.
How To Fix
Latest published version: 3.37.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.32.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually validate the outer array constraints before passing data to the Ash framework. This can be done by implementing custom validation logic in the application to check for the number of elements and the presence of nil entries in the outer array.
Conclusion
In summary, CVE-2026-82740 represents a significant vulnerability in the Ash package that can lead to improper input validation for nested arrays. It is crucial for users to update to the patched version to ensure data integrity and application reliability.
See every vulnerability recorded for ash →
FAQ
CVE-2026-82740 is a vulnerability in the Ash package that allows improper input validation for nested array attributes, potentially leading to data integrity issues.
If your application uses the Ash package and relies on nested array attributes, it may accept invalid data that violates defined constraints, which could lead to unexpected behavior or data corruption.
The vulnerability affects Ash versions from 2.16.1 up to, but not including, 3.32.2.
You can use Vulert, a tool that monitors open-source vulnerabilities, to check if your application is affected by this vulnerability. Visit Vulert Scanner to use the Vulert playground without any signup.
The CVSS score for this vulnerability is 2.1, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash.
