CVE-2026-82752: CWE-1284 Improper Validation of Specified Quantity in Input in ash-project ash

The vulnerability arises because ash-project ash uses Elixir's String.length/1 function, which counts Unicode graphemes, to enforce max_length and min_length constraints on string attributes. A grapheme can include a base character plus many combining marks, allowing a single grapheme to represent megabytes of data. Since the data storage layers (ETS, Mnesia, Postgres text columns) count codepoints rather than graphemes, an attacker can bypass length constraints by submitting strings with many combining marks, causing the system to store much larger data than intended. This leads to improper validation of input size and potential resource exhaustion or data integrity issues. The issue affects all versions from 0.10.0 before 3.33.0.

An attacker can bypass string length constraints by exploiting the difference between grapheme-based length validation and codepoint-based storage limits. This can result in storing arbitrarily large data in attributes that are supposed to have small maximum lengths, potentially causing unbounded growth in storage usage. Additionally, the mismatch can cause data truncation or rejection at the database layer, possibly leading to application errors or data loss. There is no indication of remote exploitability without local access (attack vector is local).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is provided in the input data, users should monitor the vendor's advisories for updates. Until a fix is available, consider implementing additional input validation at the application or database layer to limit input size by codepoints rather than graphemes, or restrict the use of combining marks in input strings.