{"action":"Upgrade ash to 3.37.1 or later.","affected":[{"fixed":"3.37.1","introduced":"3.24.0"}],"component":"ash","cve_ids":["CVE-2026-114214"],"ecosystem":"Hex","epss":0.00246,"exploited":false,"fixed_versions":["3.37.1"],"ghsa_id":"GHSA-g2h4-xp57-q863","id":"tcs_01M5TAQEVXN3TCP1BSN3CAJEYC","modified_at":"2026-10-25T20:11:06.823175904Z","published_at":"2026-10-25T19:47:30.612Z","references":["https://osv.dev/vulnerability/EEF-CVE-2026-114214","https://github.com/ash-project/ash/security/advisories/GHSA-g2h4-xp57-q863","https://cna.erlef.org/cves/CVE-2026-114214.html","https://github.com/ash-project/ash/commit/24f41e23dcbd9d07cde270a8141490e8f79251f5","https://github.com/ash-project/ash/commit/e37463307304b26bc8fd606322e5c4d8f7f060e5","https://hex.pm/packages/ash"],"severity":{"label":"medium","score":6},"sources":[{"source":"osv","source_id":"EEF-CVE-2026-114214","url":"https://osv.dev/vulnerability/EEF-CVE-2026-114214"},{"source":"nvd","source_id":"CVE-2026-114214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114214"}],"summary":"Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records"}