CVE-2026-82734: CWE-1284 Improper Validation of Specified Quantity in Input in ash-project ash

The vulnerability arises from Ash.Type.Decimal casting input through Ecto's decimal cast without verifying that the resulting decimal value is finite. Elixir's Decimal type permits Infinity and NaN as valid structs, which bypass min and max constraints because NaN compares as false against all bounds. Consequently, these values are stored and later cause errors during Decimal arithmetic or are rejected by the data layer, leading to failed requests. The fix involves rejecting any non-finite Decimal during casting. This affects ash versions >=1.28.0 and <3.32.2.

An attacker can submit non-finite decimal values that bypass numeric bounds validation and get persisted. This can cause failures in later arithmetic operations or data layer processing, resulting in failed requests. The impact is limited to denial of service or request failures rather than privilege escalation or data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix described involves rejecting non-finite Decimal values during casting. Until an official fix is confirmed, users should validate inputs to ensure only finite decimal values are accepted.