Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81638— Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

Quick assessment

Affected
ash-project ash_double_entry
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Erlang/Elixir 生态下的 Ash Project 中 AshDoubleEntry 存在“替代编码处理不当”漏洞 漏洞描述： 中的 存在“替代编码处理不当”（Improper Handling of Alternate Encoding）漏洞，允许攻击者提交同一标识符的不同拼写形式，从而指向相同的数据记录。 技术细节： 将 128 位 ULID 表示为 26 个 Crockford Base-32 字符。但由于 ULID 的时间戳部分前 48 位仅使用 3 位信息，因此第一个字符在规范值范围内只能是 0

CVSS 2.1 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81638

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so canonical values are 0 to 7. decode/1 in lib/ulid.ex masks the first character to its low 3 bits and valid?/1 accepts all 32 characters in that position, so 0..., 8..., G... and R... decode to the identical 16-byte value and resolve to the same row. When the type is exposed as a public ID over an HTTP or API boundary, an attacker-supplied ID can be spelled differently from the record it actually reads or writes, desynchronizing or bypassing string-level checks such as idempotency and deduplication keys, deny-lists, audit correlation, or signatures computed over the submitted ID. This issue affects ash_double_entry: from 0.1.0 before 1.0.19.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
候选编码方案处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ash-project ash_double_entry 0.1.0 ~ 1.0.19 cpe:2.3:a:ash-project:ash_double_entry:*:*:*:*:*:*:*:*
ash-project ash_double_entry 1e5f7ce8ff25f519c904731a29eb1258324e561a ~ d3e688d300a581ae214b3ca7d95ef4de63fbb050 cpe:2.3:a:ash-project:ash_double_entry:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-81638

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81638

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-81638 (1)

Vendor Advisories for CVE-2026-81638 (3)

Same Patch Batch · ash-project · 2026-09-07 · 9 CVEs total

CVE-2026-82753 8.2 HIGH Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and c
CVE-2026-82586 8.2 HIGH AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private at
CVE-2026-82755 6.3 MEDIUM ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheab
CVE-2026-82758 6.3 MEDIUM ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gat
CVE-2026-82754 6.3 MEDIUM ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypas
CVE-2026-82757 6.3 MEDIUM ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addre
CVE-2026-82756 6.3 MEDIUM ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenti
CVE-2026-82584 2.3 LOW Terminal escape sequence injection in the mix igniter.install confirmation prompt via pack

IV. Related Vulnerabilities

Same vendor: ash-project
Same weakness: CWE-173

V. Comments for CVE-2026-81638

No comments yet

Leave a comment