The vulnerability arises because ash’s Decimal type accepts Elixir Decimal structs representing Infinity or NaN without verifying that the value is finite. These non‑finite values satisfy min and max bounds because NaN compares as false against all bounds, allowing them to be stored. When later used in arithmetic or processed by the data layer, they trigger errors, causing failures in subsequent requests. The resulting impact is a denial of service, potentially affecting all functionality that relies on Ash.Type.Decimal.

The affected product is the open‑source Ash framework from ash‑project. Versions from 1.28.0 up to but not including 3.32.2 are impacted. The exact vendor is ash‑project and the product name is ash.

The CVSS score is 2.1, indicating low severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low likelihood of exploitation in the wild. The attack vector is inferred to be remote if the application exposes an API that accepts Decimal inputs, or local if unauthorized manipulation of input data is possible. Exploitation would require supplying a non‑finite value such as "Infinity" or "NaN" during input processing, which then bypasses bounds checks and leads to downstream failures. This indicates a limited exploitation scope, likely confined to environments where the vulnerable Ash version is used.