Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records

Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts

Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle

Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length

Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor

Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records

Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness

Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory

Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service

Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads

Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

Private action arguments can be set by user input in Ash

Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset