Vulnerabilities & PatchesEmerging1 src
CVE-2026-82752 - Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length
CVE ID : CVE-2026-82752
Published : Sept. 5, 2026, 6:17 p. m.
• 2 hours, 27 minutes ago
Description : Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it.
Ash measures string length with Elixir's String. length/1, which counts Unicode graphemes, in the max_length and min_length constraints of Ash. Type. String (apply_constraints/2 in lib/ash/type/string. ex), in Ash. Resource. Validation. StringLength, and in the string_length expression function.
A grapheme carries an unbounded number of combining marks, so a base character followed by a million combining acute accents is one grapheme and megabytes of data, and satisfies max_length: 2.
