{"id":18156,"date":"2026-09-08T08:30:37","date_gmt":"2026-09-08T00:30:37","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-81638"},"modified":"2026-09-08T08:30:37","modified_gmt":"2026-09-08T00:30:37","slug":"cve-2026-81638","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-81638","title":{"rendered":"CVE-2026-81638 &#8211; Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allo"},"content":{"rendered":"<p>Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier.<\/p>\n<p>AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so canonical values are 0 to 7. decode\/1 in lib\/ulid.ex masks the first character to its low 3 bits and valid?\/1 accepts all 32 characters in that position, so 0&#8230;, 8&#8230;, G&#8230; and R&#8230; decode to the identical 16-byte value and resolve to the same row. When the type is exposed as a public ID over an HTTP or API boundary, an attacker-supplied ID can be spelled differently from the record it actually reads or writes, desynchronizing or bypassing string-level checks such as idempotency and deduplication keys, deny-lists, audit correlation, or signatures computed over the submitted ID.<\/p>\n<p>This issue affects ash_double_entry: from 0.1.0 before 1.0.19.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier.<\/p>\n<p>AshDoubleEntry.ULID render<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-18156","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/18156","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=18156"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=18156"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=18156"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}