EEF-CVE-2026-82734

Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal

## Summary Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value. `Ash.Type.Decimal` cast input through Ecto's decimal cast in `cast_input/2` and `cast_stored/2` (`lib/ash/type/decimal.ex`) without checking that the resulting value is finite. Elixir's `Decimal` represents `Infinity` and `NaN` as valid structs, so a value such as `"Infinity"` or `"NaN"` passed casting and was persisted. Because `NaN` compares as false against every bound, `min` and `max` constraints do not reject it, and the stored special value later raises when used in `Decimal` arithmetic or is refused by the data layer, failing subsequent requests. The fix rejects any non-finite `Decimal` during casting. This issue affects ash: from 1.28.0 before 3.32.2.