Riskcovery

CVE-2026-82726

AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

State
Published
Severity
6.3 Medium
Published
Aug 31, 2026
Updated
Aug 31, 2026
Reserved
Aug 31, 2026

Read the record on cve.org

Description

Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header.

AshPhoenix.Helpers.get_subdomain/2 stripped the root domain with String.replace(host, ~r/.?#{root_host}/, ""). The root host was interpolated raw, so each . became a wildcard and any metacharacter a pattern, and the replace was global and unanchored, so a match was removed from anywhere in the string. With root_host example.com, Host: foo.exampleXcom.attacker.net returned the tenant foo.attacker.net. A metacharacter-bearing or nil root host degraded the pattern or raised on every request. The comparison was also case-sensitive, so TENANT.EXAMPLE.COM and EXAMPLE.COM slipped past the root-host allowlist. conn.host comes from the client Host header. The fix matches the root host case-insensitively and only as an exact trailing suffix.

This issue affects ash_phoenix: from 2.1.26 before 2.3.25.

Scores

CVSSScoreVectorSource
4.06.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NEEF

Weaknesses

  • CWE-625 Permissive Regular Expression
  • CWE-178 Improper Handling of Case Sensitivity

Affected Products

ProductVersions
ash_phoenixash-project
  • 2.1.26 to before 2.3.25Affected
ash_phoenixash-project
  • 9a5ea4d377bc263de321d79574872a3dfc4fb541 to before 8306f29e77526840c89f3cd244996ce7c0fa2cdaAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.