CVE-2026-82726
Description
Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.get_subdomain/2 stripped the root domain with String.replace(host, ~r/.?#{root_host}/, ""). The root host was interpolated raw, so each . became a wildcard and any metacharacter a pattern, and the replace was global and unanchored, so a match was removed from anywhere in the string. With root_host example.com, Host: foo.exampleXcom.attacker.net returned the tenant foo.attacker.net. A metacharacter-bearing or nil root host degraded the pattern or raised on every request. The comparison was also case-sensitive, so TENANT.EXAMPLE.COM and EXAMPLE.COM slipped past the root-host allowlist. conn.host comes from the client Host header. The fix matches the root host case-insensitively and only as an exact trailing suffix. This issue affects ash_phoenix: from 2.1.26 before 2.3.25.
How to fix
- ash-project ash_phoenix2.3.25, 8306f29e77526840c89f3cd244996ce7c0fa2cda or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ash-project ash_phoenix | 2.1.26 ≤ v < 2.3.25, 9a5ea4d377bc263de321d79574872a3dfc4fb541 ≤ v < 8306f29e77526840c89f3cd244996ce7c0fa2cda | 2.3.25, 8306f29e77526840c89f3cd244996ce7c0fa2cda |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.