CVE-2026-48593

MediumCVSS 5.9

Published: 26/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

Oban Web versions 2.12.0 before 2.12.5 have an uncontrolled resource consumption vulnerability in the Elixir.Oban.Web.CronExpr module. An attacker with cron job scheduling access can submit a malicious cron expression that, when viewed on the dashboard, allocates about 2.4 GB of memory, stalling or crashing the BEAM node.

Risk Assessment

The risk is a DoS attack by submitting a malicious cron expression that causes memory exhaustion and system crash when displayed.

Recommendation

Upgrade Oban Web to version 2.12.5 or later, which includes bounds checking for cron range expansion.

Other vulnerabilities in Oban Web

CVE-2026-48592Medium
In oban_web (Elixir.Oban.Web.Jobs.DetailComponent), the handle_event("save-job", ...) handler lacks authorization, allowing an authenticated user with read-only access to overwrite a job's worker field with any other Oban.Worker module. Other handlers (cancel, delete, retry) check permissions, but save-job does not.

Original NVD description (English source)

Uncontrolled Resource Consumption vulnerability in oban-bg oban_web ('Elixir.Oban.Web.CronExpr' modules) allows memory exhaustion via unbounded cron range expansion. An attacker with access to schedule cron jobs can submit a malicious cron expression such as "0 0 1-100000000 * *". When a user with dashboard access views the cron job list, 'Elixir.Oban.Web.CronExpr':describe/1 is called to render the expression. parse_range/1 parses both range endpoints via Integer.parse/1 with no bounds check, and the downstream helpers expand_dom_parts/1 and expand_dow_parts/1 materialise the range eagerly via Enum.to_list/1, causing allocation of ~2.4 GB and stalling or crashing the BEAM node. A sibling helper extract_dom_values already validates range bounds, but the expansion helpers do not. This issue affects oban_web: from 2.12.0 before 2.12.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS