CVE-2026-81638 Details
Description
Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so canonical values are 0 to 7. decode/1 in lib/ulid.ex masks the first character to its low 3 bits and valid?/1 accepts all 32 characters in that position, so 0..., 8..., G... and R... decode to the identical 16-byte value and resolve to the same row. When the type is exposed as a public ID over an HTTP or API boundary, an attacker-supplied ID can be spelled differently from the record it actually reads or writes, desynchronizing or bypassing string-level checks such as idempotency and deduplication keys, deny-lists, audit correlation, or signatures computed over the submitted ID. This issue affects ash_double_entry: from 0.1.0 before 1.0.19.
A vulnerability in the Ash Project's ash_double_entry library, specifically in versions 0.1.0 prior to 1.0.19, allows for improper handling of ULID (Universally Unique Lexicographically Sortable Identifier) encoding. The issue arises because the first character of a ULID, when represented in Crockford base-32, can be non-canonical and still decode to the same value. This means that different spellings of the same identifier can be accepted as equivalent, leading to potential desynchronization or bypassing of string-level checks such as idempotency keys, deny-lists, and audit correlations. The vulnerability is exploitable when the non-canonical ULID spellings are exposed as public IDs over HTTP or API interfaces.
The vulnerability has been patched in version 1.0.19 of the ash_double_entry library. Users should update to this version. After updating, ULIDs will be properly validated to ensure only canonical spellings are accepted, and applications can safely treat ULIDs as opaque values, comparing them only after normalizing to the canonical spelling.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 7, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-81638.html | EEF | AdvisoryBundle |
| https://github.com/ash-project/ash_double_entry/commit/d3e688d300a581ae214b3ca7d95ef4de63fbb050 | EEF | Source CodeVendor |
| https://github.com/ash-project/ash_double_entry/security/advisories/GHSA-qxp2-vgp9-268q | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-81638 | EEF | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-173 | Improper Handling of Alternate Encoding | EEF |
Affected Products
| Product | Versions |
|---|---|
| ash-project ash_double_entry | >= 0.1.0, < 1.0.19 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 7, 2026 | New CVE Received | EEF |