What’s Vulnerable › Products
ash-project ash vulnerabilities
30 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 31 published in the last 12 months.
Check whether your ash-project ash version is affected
Latest ash-project ash vulnerabilities
- CVE-2026-96581 — An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records (CVSS 7.6)
- CVE-2026-114214 — Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records (CVSS 6.0)
- CVE-2026-101028 — Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts (CVSS 6.0)
- CVE-2026-94201 — Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash (CVSS 8.2)
- CVE-2026-93477 — Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash (CVSS 5.9)
- CVE-2026-86338 — Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle (CVSS 6.0)
- CVE-2026-82752 — Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length (CVSS 5.9)
- CVE-2026-82747 — Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor (CVSS 5.9)
- CVE-2026-82749 — Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records (CVSS 5.9)
- CVE-2026-82748 — Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another (CVSS 2.1)
- CVE-2026-82746 — Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records (CVSS 5.9)
- CVE-2026-82745 — ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness (CVSS 5.9)
- CVE-2026-82744 — Ash.Reactor change step fails open, skipping a change when its where guard raises (CVSS 2.1)
- CVE-2026-82743 — Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads (CVSS 2.1)
- CVE-2026-82742 — Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory (CVSS 5.9)
- CVE-2026-82741 — Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion (CVSS 2.1)
- CVE-2026-82740 — Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs (CVSS 2.1)
- CVE-2026-82739 — Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error (CVSS 2.1)
- CVE-2026-82738 — Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service (CVSS 5.9)
- CVE-2026-82737 — Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads (CVSS 5.9)
- CVE-2026-82736 — Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass (CVSS 2.1)
- CVE-2026-82735 — Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service (CVSS 5.9)
- CVE-2026-82734 — Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal (CVSS 2.1)
- CVE-2026-67579 — Filter expression injection via forged keyset pagination cursor in Ash (CVSS 7.4)
- CVE-2026-70395 — Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash (CVSS 2.1)