Zach Daniel / Ash Project

Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness

Ash.Reactor change step fails open, skipping a change when its where guard raises

Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal

Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion

Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass

Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads

Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service

Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error