This vulnerability is an improper input validation error that allows any well‑formed UUID—including non‑version‑7 values—to be stored in an Ash.Type.UUIDv7 attribute. The stored 16‑byte binary is later re‑cast by the library, which only accepts version‑7 (or optionally version‑4) binaries or a 36‑character string. A non‑v7 binary matches neither clause, causing cast_stored to return an error and all subsequent reads of that record to fail. The result is a permanent corruption of the record’s ability to be retrieved, effectively a persistent denial of service for that data. No remote code execution or data exfiltration is possible, but the system’s availability for that record is compromised.

The affected product is the ash project’s Ash framework. Versions from 3.6.3 up to, but not including, 3.32.2 are impacted. Users of any downstream application that stores UUIDv7 attributes in Ash must verify their version and apply the fix.

With a CVSS score of 5.9, the vulnerability presents moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The attack vector is likely local or remote write access to a model that includes an Ash.Type.UUIDv7 field. Once an attacker stores an invalid UUID, read attempts will fail indefinitely because the corruption persists in the database. The risk is primarily availability related, with no direct confidentiality or integrity impact.