Jonatan Männchen / EEF

Authorization-redacted field values disclosed through AshTypescript result normalization

RPC error handler fails open in AshTypescript, disclosing unredacted errors

Unbounded atom creation from typed struct field names in AshTypescript field selector

Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass

Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads

Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service

Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error

Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs

Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory