CVE-2026-82736: CWE-180 Incorrect Behavior Order: Validate Before Canonicalize in ash-project ash

The vulnerability in ash-project ash involves an incorrect behavior order where validation of string constraints (max_length, min_length, and match patterns) occurs before the string is canonicalized by case-folding. Specifically, Ash.Type.CiString.apply_constraints/2 validates constraints against the original string, but the string is stored and compared in a case-folded form. This discrepancy allows an attacker to submit a string that passes validation in its original form but violates constraints once folded, such as an uppercase pattern requirement being bypassed by storing a lowercased value. The fix involves case-folding the string before applying constraints to ensure validation matches the stored form. The vulnerability affects versions from 1.29.0-rc0 before 3.32.2.

An attacker can store strings that violate defined constraints after case-folding, potentially leading to inconsistent data validation and storage. This may cause unexpected behavior in applications relying on these constraints but does not directly lead to privilege escalation or remote code execution. The CVSS score of 2.1 indicates a low impact with limited attack vector (local) and low complexity.

No official patch or fix is explicitly stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about relying on constraint validation for case-insensitive strings and consider additional validation or input sanitization as a temporary measure.