Description
Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected.

Ash.Type.String.apply_constraints/2 (lib/ash/type/string.ex) evaluated the :match regex regardless of the min_length and max_length constraints on the same attribute. Because the length check did not gate the regex, an over-length value that the length constraint rejects still had the pattern applied to it, so the length limit that would otherwise bound the work never constrained the regex input. Against a backtracking pattern this yields catastrophic regex evaluation on attacker-sized input, and even a linear pattern runs on arbitrarily large input, consuming CPU per request. The fix skips the :match regex whenever a length constraint is violated, making the two checks order-independent.

This issue affects ash: from 0.10.0 before 3.32.2.
Published: 2026-09-01
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via uncontrolled regex execution on oversized input
Action: Apply Patch
AI Analysis

Impact

The vulnerability arises when the match regex is evaluated on input that also violates length constraints. Because the length check does not gate the regex, an over‑length value still triggers the pattern, allowing attackers to craft data that forces catastrophic backtracking or excessive linear evaluation, which consumes CPU resources and results in a denial of service.

Affected Systems

ash-project ash versions from 0.10.0 up to, but not including, 3.32.2 are affected. The fix was introduced in version 3.32.2, where the regex is only applied when length constraints are satisfied.

Risk and Exploitability

With a CVSS score of 5.9, the vulnerability is moderate, and the EPSS score is not available, so the probability of exploitation is unknown. The issue is not listed in CISA KEV. The likely attack vector is an attacker sending oversized input to any endpoint that validates data with Ash.Type.String, causing the regex to run on the unbounded input. Successful exploitation leads to CPU exhaustion and potential service interruption for affected instances.

Generated by OpenCVE AI on September 1, 2026 at 04:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ash-project ash to version 3.32.2 or later.
  • If upgrade is delayed, temporarily disable or remove the :match regex validation on affected fields to prevent the regex from being applied to oversized input.
  • Implement request size limits or rate limiting at the API gateway to reject oversized payloads before they reach the application.

Generated by OpenCVE AI on September 1, 2026 at 04:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 01 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
Description Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.apply_constraints/2 (lib/ash/type/string.ex) evaluated the :match regex regardless of the min_length and max_length constraints on the same attribute. Because the length check did not gate the regex, an over-length value that the length constraint rejects still had the pattern applied to it, so the length limit that would otherwise bound the work never constrained the regex input. Against a backtracking pattern this yields catastrophic regex evaluation on attacker-sized input, and even a linear pattern runs on arbitrarily large input, consuming CPU per request. The fix skips the :match regex whenever a length constraint is violated, making the two checks order-independent. This issue affects ash: from 0.10.0 before 3.32.2.
Title Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service
First Time appeared Ash-project
Ash-project ash
Weaknesses CWE-400
CPEs cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*
Vendors & Products Ash-project
Ash-project ash
References
Metrics cvssV4_0

{'score': 5.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Ash-project Ash
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-09-01T13:11:14.176Z

Reserved: 2026-08-31T00:59:10.001Z

Link: CVE-2026-82735

cve-icon Vulnrichment

Updated: 2026-09-01T13:10:46.994Z

cve-icon NVD

Status : Deferred

Published: 2026-09-01T04:18:02.817

Modified: 2026-09-01T21:15:00.147

Link: CVE-2026-82735

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T05:00:07Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption