Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

ash

31 known vulnerabilities (7 high, 15 medium, 9 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
31 · 7 high, 15 medium, 9 low
Registry
Hex

Advisories 31

  • An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records

    Affected: from 1.22.0, fixed in 3.37.2.

  • CVE-2026-114214Medium 6.0

    Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records

    Affected: from 3.24.0, fixed in 3.37.1.

  • CVE-2026-101028Medium 6.0

    Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts

    Affected: from 2.6.0, fixed in 3.34.6.

  • Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash

    Affected: from 3.5.1, fixed in 3.34.3.

  • CVE-2026-93477Medium 5.9

    Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

    Affected: from 2.17.15, fixed in 3.33.11.

  • CVE-2026-86338Medium 6.0

    Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle

    Affected: from 2.11.0-rc.0, fixed in 3.33.4; from 2.11.0-rc.0, fixed in 3.33.4.

  • CVE-2026-82752Medium 5.9

    Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length

    Affected: from 0.10.0, fixed in 3.33.0; from 0.10.0, fixed in 3.33.0.

  • CVE-2026-82747Medium 5.9

    Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor

    Affected: from 3.4.44, fixed in 3.32.2; from 3.4.44, fixed in 3.32.2.

  • CVE-2026-82749Medium 5.9

    Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records

    Affected: from 3.13.2, fixed in 3.32.2; from 3.13.2, fixed in 3.32.2.

  • Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another

    Affected: from 3.5.13, fixed in 3.32.2; from 3.5.13, fixed in 3.32.2.

  • CVE-2026-82746Medium 5.9

    Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

    Affected: from 3.29.0, fixed in 3.32.2; from 3.29.0, fixed in 3.32.2.

  • CVE-2026-82745Medium 5.9

    ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness

    Affected: from 0.4.0, fixed in 3.32.2; from 0.4.0, fixed in 3.32.2.

  • Ash.Reactor change step fails open, skipping a change when its where guard raises

    Affected: from 3.0.0-rc.17, fixed in 3.32.2; from 3.0.0-rc.17, fixed in 3.32.2.

  • Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads

    Affected: from 2.19.0, fixed in 3.32.2; from 2.19.0, fixed in 3.32.2.

  • CVE-2026-82742Medium 5.9

    Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory

    Affected: from 1.29.0-rc0, fixed in 3.32.2; from 1.29.0-rc0, fixed in 3.32.2.

Show all 31 advisoriesShow fewer advisories

  • Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion

    Affected: from 2.14.18, fixed in 3.32.2; from 2.14.18, fixed in 3.32.2.

  • Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs

    Affected: from 2.16.1, fixed in 3.32.2; from 2.16.1, fixed in 3.32.2.

  • Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error

    Affected: from 2.17.20, fixed in 3.32.2; from 2.17.20, fixed in 3.32.2.

  • CVE-2026-82738Medium 5.9

    Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service

    Affected: from 3.6.3, fixed in 3.32.2; from 3.6.3, fixed in 3.32.2.

  • CVE-2026-82737Medium 5.9

    Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads

    Affected: from 2.14.13, fixed in 3.32.2; from 2.14.13, fixed in 3.32.2.

  • Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass

    Affected: from 1.29.0-rc0, fixed in 3.32.2; from 1.29.0-rc0, fixed in 3.32.2.

  • CVE-2026-82735Medium 5.9

    Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

    Affected: from 0.10.0, fixed in 3.32.2; from 0.10.0, fixed in 3.32.2.

  • Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal

    Affected: from 1.28.0, fixed in 3.32.2; from 1.28.0, fixed in 3.32.2.

  • Filter expression injection via forged keyset pagination cursor in Ash

    Affected: from 1.17.0, fixed in 3.31.3; from 1.17.0, fixed in 3.31.3.

  • Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash

    Affected: from 1.52.0-rc.11, fixed in 3.31.1; from 1.52.0-rc.11, fixed in 3.31.1.

  • CVE-2026-69659Medium 5.9

    Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset

    Affected: from 1.17.0, fixed in 3.31.1; from 1.17.0, fixed in 3.31.1.

  • CVE-2026-55736Medium 5.9

    Private action arguments can be set by user input in Ash

    Affected: from 3.0.0, fixed in 3.29.3; from 3.0.0, fixed in 3.29.3.

  • Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash

    Affected: fixed in 3.22.0.

  • Authorization bypass when bypass policy condition evaluates to true

    Affected: from 3.6.3, fixed in 3.7.1; from 3.6.3, fixed in 3.7.1.

  • Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization

    Affected: from 0.1.1, fixed in 3.6.2; fixed in 3.6.2; from 0.1.1, fixed in 3.6.2.

  • Before action hooks may execute in certain scenarios despite a request being forbidden

    Affected: from 0.1.1, fixed in 3.5.39; from 0.1.1, fixed in 3.5.39; fixed in 3.5.39.