Skip to content
OpenAdvisories

Package · Hex

ash_phoenix

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.3
    CVE-2026-82726

    AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

    Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.get_subdomain/2 stripped the root domain with S…

    ash-project ash_phoenix ash_phoenix Hex