CVE-2026-82740: CWE-20 Improper Input Validation in ash-project ash

The vulnerability in ash-project ash occurs in the Ash.Type.apply_constraints/3 function, which handles nested array constraints improperly. Specifically, when validating a doubly-nested array attribute ({:array, {:array, type}}), the function only applies constraints to the inner array elements and neglects constraints on the outer array such as minimum and maximum length or disallowing nil items. This allows attackers to submit outer arrays that violate these constraints, which are then accepted and persisted. The fix involves enforcing the outer array constraints and adding explicit handling for nil and non-list inputs. The affected versions are from 2.16.1 before 3.32.2.

An attacker can submit invalid outer arrays that violate constraints like maximum length or nil item restrictions, which are improperly validated and accepted by the system. This could lead to unexpected data states or logic errors in applications relying on these constraints. However, the CVSS score is low (2.1), indicating limited impact and no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a fix is available, carefully validate and sanitize input data externally to ensure compliance with expected array constraints.