CVE-2026-82735 Overview
CVE-2026-82735 is an Uncontrolled Resource Consumption vulnerability [CWE-400] in the ash-project/ash Elixir framework. The Ash.Type.String.apply_constraints/2 function in lib/ash/type/string.ex evaluated the :match regular expression regardless of whether the min_length or max_length constraints on the same attribute were violated. An attacker can submit an over-length input that the length check would reject, yet still force the regex engine to run against that input. Against a backtracking pattern this produces catastrophic regex evaluation, and even a linear pattern consumes CPU proportional to the attacker-supplied size. The issue affects ash from 0.10.0 before 3.32.2.
Critical Impact
Attackers can trigger CPU exhaustion on any Ash resource attribute that combines a :match regex with length constraints, degrading availability of the host application.
Affected Products
- ash-project ash (Elixir library) >= 0.10.0
- ash-project ash< 3.32.2
- Elixir applications relying on Ash.Type.String attribute constraints
Discovery Timeline
- 2026-09-01 - CVE-2026-82735 published to the National Vulnerability Database (NVD)
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-82735
Vulnerability Analysis
The defect lives in the constraint-evaluation loop of Ash.Type.String.apply_constraints/2. When an attribute declared both a :match regex and length bounds, the function evaluated each constraint independently and accumulated errors. Because the regex branch never consulted the length outcome, an input exceeding max_length was still passed to Regex.match?/2. The unchecked input size removes the natural upper bound on regex work, so a pattern that would normally match short strings safely instead runs on attacker-sized payloads. When the :match pattern contains ambiguous quantifiers, backtracking amplifies the CPU cost, matching the Uncontrolled Resource Consumption classification [CWE-400].
Root Cause
The root cause is missing ordering between validation checks. Length constraints are cheap and bounded; regex evaluation is data-dependent and potentially superlinear. Executing the expensive check without first honoring the cheap gate lets input that should have been rejected drive arbitrary CPU consumption.
Attack Vector
An attacker submits an over-length string to any Ash action that persists or validates a Ash.Type.String attribute defined with both :match and length constraints. The length constraint records an error, but the regex still executes on the full payload. Repeated requests amplify CPU usage on the host process, degrading availability for other tenants of the same Elixir node.
end
{:match, regex}, errors ->
- regex =
- case regex do
- {m, f, a} ->
- apply(m, f, a)
+ if length_ok?(value, constraints) do
+ regex =
+ case regex do
+ {m, f, a} ->
+ apply(m, f, a)
+
+ regex ->
+ regex
+ end
- regex ->
- regex
+ if Regex.match?(regex, value) do
+ errors
+ else
+ [
+ [message: error_message("must match the pattern %{regex}"), regex: inspect(regex)]
+ | errors
+ ]
end
-
- if Regex.match?(regex, value) do
- errors
Source: GitHub commit 14928412. The patch introduces a length_ok?(value, constraints) gate so the :match regex is skipped whenever a length constraint is violated, making the two checks order-independent.
Detection Methods for CVE-2026-82735
Indicators of Compromise
- Sustained spikes in BEAM scheduler CPU usage correlated with requests carrying oversized string fields.
- Elevated latency or timeouts on Ash-backed endpoints that accept attributes declared with both :match and max_length.
- Repeated validation-error responses citing both length and pattern failures for the same field.
Detection Strategies
- Inventory Elixir dependencies with mix deps or mix hex.outdated and flag any ash version between 0.10.0 and 3.32.2.
- Grep resource definitions for constraints: blocks that combine match: with min_length: or max_length: on Ash.Type.String attributes.
- Instrument request-size histograms per Ash action and alert when payloads exceed declared max_length values by an order of magnitude.
Monitoring Recommendations
- Enable telemetry on [:ash, :action] spans and correlate long-running events with request body sizes.
- Monitor Erlang VM metrics such as reduction counts and scheduler utilization to catch regex-driven CPU saturation.
- Rate-limit or size-cap upstream reverse proxies to reject over-length payloads before they reach the Elixir application.
How to Mitigate CVE-2026-82735
Immediate Actions Required
- Upgrade ash to version 3.32.2 or later using mix deps.update ash and redeploy affected services.
- Audit all Ash.Type.String attributes that define a :match regex and confirm a bounded max_length is also set.
- Add request-size limits at the web tier (Phoenix endpoint or reverse proxy) to reject oversized bodies before dispatch.
Patch Information
The fix is committed in ash3.32.2. Review the GitHub Security Advisory GHSA-mq7g-pffw-m8xh, the CNA advisory from the Erlang Ecosystem Foundation, and the OSV entry EEF-CVE-2026-82735 for the authoritative advisories.
Workarounds
- Temporarily replace complex backtracking regexes with anchored, linear-time alternatives until the upgrade is deployed.
- Enforce strict body-size limits in Plug.Parsers (for example, length: 100_000) to bound input before it reaches Ash validators.
- Add pre-validation in custom changes or preparations that rejects strings exceeding the declared max_length before other constraints run.
# Configuration example: upgrade ash and verify the resolved version
mix deps.update ash
mix deps.get
mix hex.info ash | grep -i version
# Ensure the locked version is >= 3.32.2
grep '"ash"' mix.lock
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
