CVE-2026-78228

MediumCVSS 5.9

Published: 30/08/2026(UTC)Translated: 30/08/2026(UTC)NVD NIST

Summary

An uncontrolled recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger's on_error action to fail on the final attempt to exhaust worker CPU and memory, denying service. The generated worker's atomic handle_error/4 runs the trigger's on_error action on a job's final attempt inside a rescue that, when the action itself raises, calls handle_error/4 again with the same job, leading to infinite recursion and unbounded heap growth. This issue affects ash_oban from 0.8.0-rc.1 before 0.8.14.

Risk Assessment

Risk of denial of service, potentially leading to system unavailability and disruption.

Recommendation

Update ash_oban to version 0.8.14 or later and review on_error action configuration to avoid deterministic failures.

Other vulnerabilities in ash_oban

CVE-2026-78038Medium
A vulnerability in ash_oban allows a user whose input reaches the :args option of AshOban.build_trigger/3 to retarget an update or destroy trigger at another record, including across tenants. This occurs because caller keys arrive as strings after JSON round-trip, bypassing merge collision handling and allowing override of trusted values.

Original NVD description (English source)

Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger's on_error action to fail on the final attempt to exhaust worker CPU and memory, denying service. The generated worker's atomic handle_error/4 runs the trigger's on_error action on a job's final attempt inside a rescue that, when the action itself raises, calls handle_error/4 again with the same job. The job's attempt still equals max_attempts, so it re-enters the same clause and re-runs the failing action, with no exit. Any deterministic on_error failure (a data-layer outage, a misconfigured action, or a record the action rejects) loops forever; because the recursive call is not in tail position, each iteration retains a formatted stacktrace and the process heap grows without bound while the failing statement is re-issued against the data layer until the runtime kills the worker. This issue affects ash_oban: from 0.8.0-rc.1 before 0.8.14.