Ash-Project Ash
31 CVEs affecting Ash-Project Ash. Latest disclosed: 2026-10-26. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34593 | High | 7.5 | 2026-04-02 | Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type.Module.cast_input/2 unconditionally cr… |
CVE-2026-67579 | High | 7.4 | 2026-08-12 | Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pag… |
CVE-2026-69659 | Medium | 5.5 | 2026-08-09 | Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor… |
CVE-2026-96581 | | 2026-10-26 | Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's… | |
CVE-2026-114214 | | 2026-10-25 | Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relations… | |
CVE-2026-101028 | | 2026-10-09 | Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and As… | |
CVE-2026-94201 | | 2026-10-05 | Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced th… | |
CVE-2026-93477 | | 2026-09-25 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private act… | |
CVE-2026-86338 | | 2026-09-16 | Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is r… | |
CVE-2026-82752 | | 2026-09-05 | Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose… | |
CVE-2026-82747 | | 2026-09-01 | Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an access_type :r… | |
CVE-2026-82749 | | 2026-09-01 | Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match unintended records when the referenced par… | |
CVE-2026-82748 | | 2026-09-01 | Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can ru… | |
CVE-2026-82746 | | 2026-09-01 | Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.update_m… | |
CVE-2026-82745 | | 2026-09-01 | Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because n… | |
CVE-2026-82744 | | 2026-09-01 | Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run… | |
CVE-2026-82743 | | 2026-09-01 | Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits… | |
CVE-2026-82742 | | 2026-09-01 | Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relati… | |
CVE-2026-82741 | | 2026-09-01 | Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that us… | |
CVE-2026-82740 | | 2026-09-01 | Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested {:array, {:array, type}} attribute… |