Improper Input Validation in Ash Framework by Ash Project

CVE-2026-82734

What is CVE-2026-82734?

A flaw in the Ash Framework allows attackers to submit non-finite decimal values, bypassing numeric bounds constraints. This occurs in the decimal casting operations, where values like 'Infinity' or 'NaN' can be processed without proper validation. Such inputs lead to failures during arithmetic operations and cause disruptions in further data handling. The vulnerability is addressed in subsequent versions, rejecting non-finite Decimal inputs during the casting process.

References