AIKIDO-2026-75961

TL;DR

Ash measures string length in Unicode graphemes when enforcing max_length and min_length constraints on Ash.Type.String, the StringLength validation, and the string_length expression function. A single grapheme can absorb an unbounded number of combining marks, so a multi megabyte value counts as one grapheme and satisfies a small max_length. Any client that submits such a string to a length constrained attribute can store a value far larger than the resource declares, consuming storage and request body capacity the constraint was meant to bound. The fix measures length by codepoints or bytes instead of graphemes.