CVE-2026-82734: ash-project ash Decimal Input Vulnerability

CVE-2026-82734 Overview

CVE-2026-82734 is an Improper Validation of Specified Quantity in Input vulnerability [CWE-1284] in the ash-project/ash framework for Elixir. The Ash.Type.Decimal type casts input through Ecto's decimal cast in cast_input/2 and cast_stored/2 without verifying that the resulting value is finite. An attacker can submit "Infinity" or "NaN" as a decimal value, and the framework accepts and persists it. Because NaN compares as false against every bound, min and max constraints do not reject it. The stored special value later raises during arithmetic or gets refused by the data layer, breaking subsequent requests.

Critical Impact
Attackers can bypass numeric bounds validation and inject non-finite decimal values that corrupt downstream operations, causing runtime exceptions and failed requests.

Affected Products

ash-project/ash (Elixir package)
Versions from 1.28.0 up to (but not including) 3.32.2
Applications relying on Ash.Type.Decimal for input validation

Discovery Timeline

2026-09-01 - CVE-2026-82734 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82734

Vulnerability Analysis

The vulnerability resides in lib/ash/type/decimal.ex, specifically in the cast_input/2 and cast_stored/2 functions. These functions delegate parsing to Ecto's decimal cast but do not validate the finiteness of the parsed result. Elixir's Decimal library treats Infinity, -Infinity, and NaN as valid struct representations. When such a value is submitted, casting succeeds and the value flows through the framework's constraint layer.

Min and max bounds constraints rely on numeric comparison. NaN is unordered relative to any real number, so every comparison returns false. As a result, bounds checks silently accept the value. The corrupted value persists to the data store and later triggers exceptions during arithmetic or is rejected by the underlying database, breaking user-facing operations.

Root Cause

The root cause is missing finiteness validation on the output of Decimal.parse/1. The casting path returns {:ok, decimal} for any successfully parsed struct without distinguishing finite numbers from special values like Infinity and NaN.

Attack Vector

An attacker with the ability to submit input to any Ash resource attribute or argument typed as Ash.Type.Decimal can pass the string "Infinity", "-Infinity", or "NaN". The value bypasses bounds constraints and is persisted or propagated. Subsequent operations that perform arithmetic on the stored value raise runtime exceptions, resulting in a limited integrity and availability impact.

text

   def cast_input(value, _constraints) when is_binary(value) do
     case Decimal.parse(value) do
       {decimal, ""} ->
-        {:ok, decimal}
+        ensure_finite(decimal)

       _ ->
         :error

Source: GitHub Ash Project Commit 818087b. The patch replaces the direct {:ok, decimal} return with a call to ensure_finite/1, which rejects Infinity and NaN values during casting.

Detection Methods for CVE-2026-82734

Indicators of Compromise

Application logs containing Decimal arithmetic exceptions such as ArithmeticError or Decimal.Error referencing NaN or Infinity operands.
Database driver errors rejecting non-finite numeric values on insert or update operations.
Failed requests correlated with prior input submissions containing the literal strings Infinity, -Infinity, or NaN in decimal-typed fields.

Detection Strategies

Audit request logs and API gateway traffic for decimal-typed parameters carrying non-numeric literals like NaN or Infinity.
Instrument Ash.Type.Decimal code paths in vulnerable versions to log parsed struct values before persistence.
Query stored decimal columns for special-value markers using database-native functions such as PostgreSQL's is_nan or is_infinite.

Monitoring Recommendations

Alert on repeated Decimal-related runtime exceptions in application error tracking systems.
Monitor input validation telemetry for anomalous rejections or missing rejections on decimal fields.
Track dependency versions of the ash package across build pipelines to identify hosts running affected releases.

How to Mitigate CVE-2026-82734

Immediate Actions Required

Upgrade the ash dependency to version 3.32.2 or later in all affected Elixir projects.
Review persisted decimal columns for existing non-finite values and remediate corrupted records.
Add explicit finiteness validation to any custom decimal handling code paths outside of Ash.Type.Decimal.

Patch Information

The fix is committed in ash-project/ash commit 818087b and released in version 3.32.2. Full advisory details are available at the GitHub Security Advisory GHSA-mvvh-q33h-q62v and the Erlang Ecosystem Foundation CNA advisory.

Workarounds

Add a custom validation on decimal attributes that rejects non-finite values before they reach Ash.Type.Decimal casting.
Sanitize inbound API payloads at the controller or plug layer, stripping requests where decimal fields match Infinity, -Infinity, or NaN.
Enforce database-level CHECK constraints on decimal columns to reject non-finite values as a defense-in-depth measure.

bash

# Update mix.exs and fetch the patched version
# {:ash, "~> 3.32.2"}
mix deps.update ash
mix deps.get