Issued CVEs

CVE ID	Title	Packages	Severity	Published
CVE-2026-82744	Ash.Reactor change step fails open, skipping a change when its where guard raises	Hex / ash GitHub / ash-project/ash	L 2.1	2026-09-01
CVE-2026-82743	Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads	Hex / ash GitHub / ash-project/ash	L 2.1	2026-09-01
CVE-2026-82742	Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory	Hex / ash GitHub / ash-project/ash	M 5.9	2026-09-01
CVE-2026-82741	Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion	Hex / ash GitHub / ash-project/ash	L 2.1	2026-09-01
CVE-2026-82740	Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs	Hex / ash GitHub / ash-project/ash	L 2.1	2026-09-01
CVE-2026-82739	Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error	Hex / ash GitHub / ash-project/ash	L 2.1	2026-09-01
CVE-2026-82738	Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service	Hex / ash GitHub / ash-project/ash	M 5.9	2026-09-01
CVE-2026-82737	Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads	Hex / ash GitHub / ash-project/ash	M 5.9	2026-09-01
CVE-2026-82736	Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass	Hex / ash GitHub / ash-project/ash	L 2.1	2026-09-01
CVE-2026-82735	Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service	Hex / ash GitHub / ash-project/ash	M 5.9	2026-09-01
CVE-2026-82734	Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal	Hex / ash GitHub / ash-project/ash	L 2.1	2026-09-01
CVE-2026-82731	Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection	Hex / ash_typescript GitHub / ash-project/ash_typescript	L 2.3	2026-09-01
CVE-2026-74837	Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter	Hex / ash_typescript GitHub / ash-project/ash_typescript	H 8.7	2026-09-01
CVE-2026-82733	Route handler return value echoed into AshTypescript error response	Hex / ash_typescript GitHub / ash-project/ash_typescript	M 6.3	2026-09-01
CVE-2026-82732	Declared argument constraints not enforced on AshTypescript typed controller routes	Hex / ash_typescript GitHub / ash-project/ash_typescript	M 6.3	2026-09-01
CVE-2026-82730	Authorization-redacted field values disclosed through AshTypescript result normalization	Hex / ash_typescript GitHub / ash-project/ash_typescript	H 8.2	2026-09-01
CVE-2026-77950	RPC error handler fails open in AshTypescript, disclosing unredacted errors	Hex / ash_typescript GitHub / ash-project/ash_typescript	M 6.3	2026-09-01
CVE-2026-77856	Unbounded atom creation from typed struct field names in AshTypescript field selector	Hex / ash_typescript GitHub / ash-project/ash_typescript	H 8.2	2026-09-01
CVE-2026-82725	AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data	Hex / ash_phoenix GitHub / ash-project/ash_phoenix	L 2.3	2026-08-31
CVE-2026-82724	Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain	Hex / ash_phoenix GitHub / ash-project/ash_phoenix	H 7.6	2026-08-31
CVE-2026-82726	AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant	Hex / ash_phoenix GitHub / ash-project/ash_phoenix	M 6.3	2026-08-31
CVE-2026-82727	AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message	Hex / ash_phoenix GitHub / ash-project/ash_phoenix	L 2.3	2026-08-31
CVE-2026-82673	Path traversal in AshAdmin file uploads via unsanitized client filename	Hex / ash_admin GitHub / ash-project/ash_admin	H 8.3	2026-08-31
CVE-2026-81853	AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle	Hex / ash_admin GitHub / ash-project/ash_admin	L 2.3	2026-08-31
CVE-2026-81852	AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass	Hex / ash_admin GitHub / ash-project/ash_admin	L 2.1	2026-08-31

CVE-2026-82744

Ash.Reactor change step fails open, skipping a change when its where guard raises

Hex / ash

GitHub / ash-project/ash

L 2.1

2026-09-01

CVE-2026-82743

Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads

Hex / ash

GitHub / ash-project/ash

L 2.1

2026-09-01