CVE-2026-82735: CWE-400 Uncontrolled Resource Consumption in ash-project ash

The vulnerability in ash-project ash occurs in the Ash.Type.String.apply_constraints/2 function, where the :match regex is evaluated regardless of min_length and max_length constraints. This means that inputs exceeding length limits still undergo regex evaluation, which can be computationally expensive, especially with backtracking patterns, leading to uncontrolled resource consumption (CWE-400). The issue affects versions starting at 0.10.0 and before 3.32.2. The remediation is to skip the regex evaluation when length constraints are violated, making the checks order-independent and preventing excessive CPU usage.

An attacker can supply input that exceeds length constraints but still triggers expensive regex evaluation, causing high CPU consumption per request. This can degrade system performance or lead to denial of service conditions due to resource exhaustion. The impact is limited to local attack vector with low attack complexity and no user interaction required, but it requires partial user privileges. There is no known exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix is to skip regex evaluation when length constraints are violated, but no official patch or vendor advisory is provided in the data. Monitor vendor channels for an official fix and apply it once available.