CVE-2026-81638
LowCVSS 2.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability in ash_double_entry of the ash-project allows an attacker to submit several distinct string spellings of the same ULID identifier. Due to improper masking of the first character, multiple strings decode to the same value, enabling desynchronization of string-level checks such as idempotency keys or deny-lists.
Risk Assessment
The risk includes bypassing security mechanisms based on string comparison, potentially leading to unauthorized access, data integrity issues, or business logic attacks.
Recommendation
It is recommended to upgrade ash_double_entry to version 1.0.19 or later, which includes the fix. Also consider server-side validation of identifiers to reject non-canonical representations.
Related vulnerabilities
- CVE-2026-114425Critical
SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.
- CVE-2026-114424Critical
SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules. An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context when an active rule uses message-derived replacement data and its search condition matches. The validated worker context was root.
- CVE-2026-121802Critical
@better-auth/expo before 1.7.16 signs a caller-supplied state value without verifying that it was issued by the server. This allows account-takeover outcomes, such as unauthenticated changes of any account's email address.
- CVE-2026-121615Critical
Linksys E5600 1.1.0.26 contains an improper authentication vulnerability in /cgi-bin/mesh_login.cgi (Login Handler). The attack can be launched remotely and the exploit has been publicly disclosed. The vendor did not respond and the product is no longer supported.
- CVE-2026-121609Critical
A vulnerability was identified in the Qihoo 360 Whole Home Router M5 version 4.0.17.1566 within the boot script /etc/init.d/mpt (Home function). The issue involves hard-coded credentials. The exploit is publicly available and remote exploitation is possible.
- CVE-2026-121607Critical
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to version 6.4.9 in the testspeed_command function of /fs2/bin/iscm. Manipulating the host argument results in OS command injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-121606Critical
A vulnerability was found in Qihoo 360 devices (models D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9) in the verify_sign function of fs2/bin/iscm responsible for firmware signature verification. Manipulating the sign argument leads to improper verification of cryptographic signatures. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-121600Critical
A vulnerability was found in TOTOLINK A950RG version 4.1.2cu.5268_B20221104 in the setMacFilterRules function of /cgi-bin/cstecgi.cgi handling MAC filtering. Manipulating the addEffect argument causes a stack-based buffer overflow. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-121599Critical
A vulnerability was detected in TOTOLINK A950RG version 4.1.2cu.5268_B20221104 in the setWiFiMultipleConfig/delWiFiMultipleConfig functions of /cgi-bin/cstecgi.cgi handling Multi-SSID configuration. Manipulating the wepkey2/wepkey3 arguments results in a stack-based buffer overflow. The attack can be launched remotely and the exploit is now public.
- CVE-2026-121598Critical
A security vulnerability was detected in TOTOLINK A950RG version 4.1.2cu.5268_B20221104 in the strcpy function of /cgi-bin/cstecgi.cgi handling basic wireless configuration. Manipulating the wepkey argument leads to a stack-based buffer overflow. The attack can be initiated remotely and the exploit has been publicly disclosed.
Original NVD description (English source)
Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so canonical values are 0 to 7. decode/1 in lib/ulid.ex masks the first character to its low 3 bits and valid?/1 accepts all 32 characters in that position, so 0..., 8..., G... and R... decode to the identical 16-byte value and resolve to the same row. When the type is exposed as a public ID over an HTTP or API boundary, an attacker-supplied ID can be spelled differently from the record it actually reads or writes, desynchronizing or bypassing string-level checks such as idempotency and deduplication keys, deny-lists, audit correlation, or signatures computed over the submitted ID. This issue affects ash_double_entry: from 0.1.0 before 1.0.19.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS