Integer Overflow Vulnerability in Ash Project for Elixir by Ash-Project

CVE-2026-82737

What is CVE-2026-82737?

The vulnerability exists due to improper validation of input dimensions in Ash Project's vector handling. When an attacker submits a vector exceeding 65,535 elements, it triggers a wraparound issue in the dimension count. This flaw allows the attacker to corrupt stored vectors, ultimately causing any subsequent reads of the affected data to misparse. As a result, access to the corrupted records is denied, leading to potential disruptions and data integrity concerns. The issue has been addressed by implementing a check to reject vectors with dimensions exceeding the maximum allowed size.

References