EEF-CVE-2026-82726

AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

## Summary Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted `Host` header. `AshPhoenix.Helpers.get_subdomain/2` stripped the root domain with `String.replace(host, ~r/.?#{root_host}/, "")`. The root host was interpolated raw, so each `.` became a wildcard and any metacharacter a pattern, and the replace was global and unanchored, so a match was removed from anywhere in the string. With `root_host` `example.com`, `Host: foo.exampleXcom.attacker.net` returned the tenant `foo.attacker.net`. A metacharacter-bearing or `nil` root host degraded the pattern or raised on every request. The comparison was also case-sensitive, so `TENANT.EXAMPLE.COM` and `EXAMPLE.COM` slipped past the root-host allowlist. `conn.host` comes from the client `Host` header. The fix matches the root host case-insensitively and only as an exact trailing suffix. This issue affects ash_phoenix: from 2.1.26 before 2.3.25. ## Configurations The application uses subdomain-based multitenancy via `AshPhoenix.Helpers.get_subdomain/2` (for example through `AshPhoenix.LiveView.SubdomainHook`) to select the tenant from the request host.