Skip to content

RadicalNotion.AI

We do not sell or share your personal information.

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Log in Create an account

Home
Patched Functions
Ash Project
Ash

ash-project/ash: Functions Patched by CVE Fixes

elixir

#163 of 500 repositories

ash-project/ash

Functions and files changed by CVE fixes in this repository.

Latest located fix October 9, 2026

29

CVE fixes located

Published CVEs

119

Functions patched

Distinct function sites

73

Files patched

Distinct source files

2025–2026

Years covered

By CVE publication date

Overview

29 published CVEs have a fix traced to functions in ash-project/ash, the earliest published in 2025. Those fixes changed 119 distinct functions across 73 files, in 727 patch hunks.

Among the 500 repositories tracked here, ash-project/ash ranks #163 by the number of CVEs with a located fix.

Most patched functions

Functions in ash-project/ash changed by the most CVE fixes.

1length_oklib/ash/type/string.ex2 CVEs · 2 patches2026
2projectmix.exs2 CVEs · 1 patches2025
3startlib/ash/application.ex2 CVEs · 1 patches2025
4hellolib/ash.ex2 CVEs · 1 patches2025
5run_count_querylib/ash/actions/read.ex1 CVEs · 1 patches2026
6newlib/ash/query/aggregate.ex1 CVEs · 1 patches2026
7unquotelib/ash/query/aggregate.ex1 CVEs · 1 patches2026
8filter_with_relatedlib/ash/actions/read.ex1 CVEs · 1 patches2026
9canlib/ash/data_layer/ets/ets.ex1 CVEs · 1 patches2026
10aggregatelib/ash/api/interface.ex1 CVEs · 1 patches2026
11runlib/ash/actions/aggregate.ex1 CVEs · 1 patches2026
12aggregate_optslib/ash/api/api.ex1 CVEs · 1 patches2026
13update_aggregate_filterslib/ash/actions/read.ex1 CVEs · 1 patches2026
14auth_requestlib/ash/query/aggregate.ex1 CVEs · 1 patches2026
15authorize_relatedlib/ash/actions/read/read.ex1 CVEs · 1 patches2026

Most patched files

Files in ash-project/ash changed by the most CVE fixes.

1lib/ash/policy/authorizer/authorizer.ex4 CVEs · 5 functions
2lib/ash/changeset/changeset.ex3 CVEs · 10 functions
3lib/ash/policy/policy.ex3 CVEs · 10 functions
4lib/ash/data_layer/ets/ets.ex3 CVEs · 5 functions
5lib/ash/actions/update/bulk.ex3 CVEs · 2 functions
6mix.exs3 CVEs · 2 functions
7.formatter.exs3 CVEs · 0 functions
8lib/ash/type/string.ex2 CVEs · 6 functions
9lib/ash/type/ci_string.ex2 CVEs · 5 functions
10lib/ash/actions/read.ex2 CVEs · 4 functions

Fix size

How much code a CVE fix in ash-project/ash changes, with backports counted once.

30

Median lines changed

Added plus removed, per CVE

45%

Fixes of 20 lines or fewer

Share of CVE fixes

31%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in ash-project/ash, and the functions each fix changed.

Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts
CVE-2026-101028authorize_related aggregate run
Medium · CVSS 6.0
EPSS 0.3%2026-10-09
Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash
CVE-2026-94201coerce cast_input dump_to_native
High · CVSS 8.2
EPSS 0.3%2026-10-05
Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash
CVE-2026-93477run bulk_update changeset
Medium · CVSS 5.9
EPSS 0.2%2026-09-25
Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle
CVE-2026-86338alter_filter do_replace_ref after
Medium · CVSS 6.0
EPSS 0.4%2026-09-16
Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length
CVE-2026-82752error_message length_generator cast_atomic
Medium · CVSS 5.9
EPSS 0.2%2026-09-05
Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
CVE-2026-82747
Medium · CVSS 5.9
EPSS 0.2%2026-09-01
Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records
CVE-2026-82749resolve_parent_in_filter
Medium · CVSS 5.9
EPSS 0.2%2026-09-01
Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another
CVE-2026-82748
Low · CVSS 2.1
EPSS 0.2%2026-09-01
Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records
CVE-2026-82746authorize_atomic authorize_atomic_changeset
Medium · CVSS 5.9
EPSS 0.2%2026-09-01
ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness
CVE-2026-82745pkey_already_taken_error get_valid_pkey
Medium · CVSS 5.9
EPSS 0.2%2026-09-01
Ash.Reactor change step fails open, skipping a change when its where guard raises
CVE-2026-82744apply_validation
Low · CVSS 2.1
EPSS 0.2%2026-09-01
Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads
CVE-2026-82743await_at_least_one
Low · CVSS 2.1
EPSS 0.2%2026-09-01

Get an alert for each new ash-project/ash CVE, with the patched functions and AI-written analysis.

Monitor ash CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

android.googlesource.com/platform-frameworks-native29 CVEs debian/cacti29 CVEs electron/electron29 CVEs matrix-org/synapse29 CVEs MervinPraison/PraisonAI29 CVEs mybb/mybb29 CVEs openstack/keystone29 CVEs payloadcms/payload29 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in ash-project/ash.

How many CVEs have a located fix in ash-project/ash?: 29 published CVEs have a fix traced to functions in ash-project/ash, touching 119 functions across 73 files.
Which function in ash-project/ash has been patched by the most CVEs?: length_ok in lib/ash/type/string.ex has been changed by 2 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in ash-project/ash?: The median fix changes 30 lines. 45% of fixes change 20 lines or fewer, and 31% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

ash-project/ash on GitHub (opens in a new tab)
Patched functions directory
CWE directory: the weakness types behind these fixes

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track ash-project/ash CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing

On this page

Overview
Most patched functions
Most patched files
Fix size
Latest CVEs
Other repositories
FAQ
References