The vulnerability in the Ash data‑platform library causes its string‑length validations to count Unicode graphemes instead of codepoints. A single base character followed by many combining marks is considered one grapheme, so a string containing a base character and a million accents is counted as one and can satisfy a tiny max_length value like 2. If the underlying database does not impose a separate limit, the entire payload is written to storage, allowing an attacker to store megabytes of data in an attribute that was declared very small. This results in uncontrolled growth of database size and can lead to disk‑space exhaustion or denial of service. The flaw is a typical example of CWE‑1284, improper quantity validation.

Ash Project Ash, versions 0.10.0 through 3.32.x (prior to 3.33.0)

The CVSS score of 5.9 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not been observed. The attack is likely to be remote, as the flaw is triggered by supplied input that bypasses application‑level length checks. If an attacker can submit large payloads, the database will accept and store them, potentially exhausting disk space. Because no additional client‑side checks are present, the exploitation barrier is low for systems that allow unsigned requests to reach the library.