Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps ash-project/ash (generic), ash-project/ash (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for ash-project/ash, ash-project/ash.
2. 2Review the reported fix. Update ash-project/ash to 3.32.2; ash-project/ash to 7dfe5f0b1ba4267580ded947dc861351d4dc8e2b if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Sep 1, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 1, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 1, 2026

Sources and claim methodology

• Source referencecna.erlef.org
• GitHub security advisorygithub.com
• GitHub security advisorygithub.com
• Source referenceosv.dev

Related CVEs

• Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.DecimalSame ash-project/ash package
• Match regex runs on over-length input in Ash.Type.String, enabling regex denial of serviceSame ash-project/ash package
• Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypassSame ash-project/ash package
• Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing readsSame ash-project/ash package
• Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of serviceSame ash-project/ash package
• Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputsSame ash-project/ash package