CVE-2026-82735: Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

Severity: medium (CVSS 5.9 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-01 · updated 2026-09-01
Weakness: CWE-400

Description

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.apply_constraints/2 (lib/ash/type/string.ex) evaluated the :match regex regardless of the min_length and max_length constraints on the same attribute. Because the length check did not gate the regex, an over-length value that the length constraint rejects still had the pattern applied to it, so the length limit that would otherwise bound the work never constrained the regex input. Against a backtracking pattern this yields catastrophic regex evaluation on attacker-sized input, and even a linear pattern runs on arbitrarily large input, consuming CPU per request. The fix skips the :match regex whenever a length constraint is violated, making the two checks order-independent. This issue affects ash: from 0.10.0 before 3.32.2.

Affected products

ash-project ash: from 0.10.0 before 3.32.2 — fixed in 3.32.2

How to fix

Upgrade to a fixed version: ash-project ash 3.32.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-82735 or the next vulnerability affects your stack