The vulnerability arises because the Ash.Type.apply_constraints/3 function fails to enforce constraints declared on the outer array when the attribute is defined as a doubly‑nested {:array, {:array, type}}. As a result, policy rules such as min_length, max_length, and nil_items? are ignored, letting an attacker submit an outer list that violates these rules. The data is then accepted and stored, compromising the integrity of application state. This weakness is a classic example of improper input validation (CWE‑20).

The flaw affects the Ash framework (ash-project:ash) for all releases between version 2.16.1 and before 3.32.2. Any application that relies on these releases and defines nested array attributes is susceptible.

The CVSS score is 2.1, indicating low severity. No EPSS score is available, suggesting that exploitation is not expected to be common. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply structured input that satisfies the inner array constraints but violates the outer ones; therefore the exploitation vector is likely application‑level input via API or UI. Due to the low severity and lack of publicly known exploit code, the risk to systems remains modest, but the integrity of persisted data can be impacted.