ash-project ash double entry vulnerabilities

Latest ash-project ash double entry CVEs

Newest publication first

1. CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

   Published 2026-09-07

   Low·CVSS 2.1 EPSS 0.19%

   Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character enco...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.