Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-82735— Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

Quick assessment

Affected

ash-project ash

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Ash Framework是Ash Framework组织的一款基于Elixir的开发框架。 Ash Framework 0.10.0版本至3.32.2之前版本存在资源管理错误漏洞，该漏洞源于lib/ash/type/string.ex文件中的Ash.Type.String.apply_constraints/2函数未根据min_length和max_length长度约束限制:match正则表达式执行，攻击者可利用超长输入触发高开销正则表达式，导致CPU资源消耗，可能造成拒绝服务。

CVSS 5.9 · Medium EPSS 0.18% · P7 Updated Sep 01, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

Vendor	Product	Version Range	Status
ash-project	ash	`0.10.0< 3.32.2`	affected
		`05848d5f4affe60fddd812222a18ada080c0813b< 14928412a1a94a69c47df8e98920d3a2b09cdec4`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82735

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

Source: CVE Program / CVE List V5

Vulnerability Description

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.apply_constraints/2 (lib/ash/type/string.ex) evaluated the :match regex regardless of the min_length and max_length constraints on the same attribute. Because the length check did not gate the regex, an over-length value that the length constraint rejects still had the pattern applied to it, so the length limit that would otherwise bound the work never constrained the regex input. Against a backtracking pattern this yields catastrophic regex evaluation on attacker-sized input, and even a linear pattern runs on arbitrarily large input, consuming CPU per request. The fix skips the :match regex whenever a length constraint is violated, making the two checks order-independent. This issue affects ash: from 0.10.0 before 3.32.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

未加控制的资源消耗(资源穷尽)

Source: CVE Program / CVE List V5

Vulnerability Title

Ash Framework 资源管理错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ash-project	ash	0.10.0 ~ 3.32.2	`cpe:2.3:a:ash-project:ash::::::::`
ash-project	ash	05848d5f4affe60fddd812222a18ada080c0813b ~ 14928412a1a94a69c47df8e98920d3a2b09cdec4	`cpe:2.3:a:ash-project:ash::::::::`

II. Public POCs for CVE-2026-82735

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-82735

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-82735 (1)

🔗 fix: skip string match regex once a length constraint is violated · ash-project/ash@1492841 · GitHub Read full article patch

Vendor Advisories for CVE-2026-82735 (2)

Other References for CVE-2026-82735 (1)

🔗 EEF-CVE-2026-82735 - OSV Read full article related

https://www.cve.org/CVERecord?id=CVE-2026-82735

Same Patch Batch · ash-project · 2026-09-01 · 23 CVEs total

CVE-2026-74837	8.7 HIGH	Unbounded atom creation from client-supplied RPC field names in AshTypescript field format
CVE-2026-77856	8.2 HIGH	Unbounded atom creation from typed struct field names in AshTypescript field selector
CVE-2026-82730	8.2 HIGH	Authorization-redacted field values disclosed through AshTypescript result normalization
CVE-2026-77950	6.3 MEDIUM	RPC error handler fails open in AshTypescript, disclosing unredacted errors
CVE-2026-82733	6.3 MEDIUM	Route handler return value echoed into AshTypescript error response
CVE-2026-82732	6.3 MEDIUM	Declared argument constraints not enforced on AshTypescript typed controller routes
CVE-2026-82747	5.9 MEDIUM	Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
CVE-2026-82749	5.9 MEDIUM	Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is
CVE-2026-82746	5.9 MEDIUM	Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to for
CVE-2026-82745	5.9 MEDIUM	ETS and Mnesia data layers overwrite an existing record on create instead of enforcing pri
CVE-2026-82737	5.9 MEDIUM	Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting
CVE-2026-82742	5.9 MEDIUM	Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships,
CVE-2026-82738	5.9 MEDIUM	Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of
CVE-2026-82731	2.3 LOW	Unescaped path parameters in AshTypescript generated TypeScript client allow request redir
CVE-2026-82736	2.1 LOW	Ash.Type.CiString validates length and match constraints before case folding, allowing con
CVE-2026-82741	2.1 LOW	Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion
CVE-2026-82740	2.1 LOW	Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs
CVE-2026-82734	2.1 LOW	Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal
CVE-2026-82743	2.1 LOW	Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads
CVE-2026-82744	2.1 LOW	Ash.Reactor change step fails open, skipping a change when its where guard raises

Showing top 20 of 23 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: ash

Same vendor: ash-project

Same weakness: CWE-400