oban-bg oban_web up to 2.12.4 Elixir.Oban.Web.CronExpr parse_range resource consumption

Summaryinfo

A vulnerability marked as problematic has been reported in oban-bg oban_web up to 2.12.4. Affected by this issue is the function parse_range of the component Elixir.Oban.Web.CronExpr. Performing a manipulation results in resource consumption. This vulnerability is reported as CVE-2026-48593. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in oban-bg oban_web up to 2.12.4. This affects the function parse_range of the component Elixir.Oban.Web.CronExpr. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. The summary by CVE is:

Uncontrolled Resource Consumption vulnerability in oban-bg oban_web ('Elixir.Oban.Web.CronExpr' modules) allows memory exhaustion via unbounded cron range expansion. An attacker with access to schedule cron jobs can submit a malicious cron expression such as "0 0 1-100000000 * *". When a user with dashboard access views the cron job list, 'Elixir.Oban.Web.CronExpr':describe/1 is called to render the expression. parse_range/1 parses both range endpoints via Integer.parse/1 with no bounds check, and the downstream helpers expand_dom_parts/1 and expand_dow_parts/1 materialise the range eagerly via Enum.to_list/1, causing allocation of ~2.4 GB and stalling or crashing the BEAM node. A sibling helper extract_dom_values already validates range bounds, but the expansion helpers do not. This issue affects oban_web: from 2.12.0 before 2.12.5.

The weakness was disclosed by Peter Ullrich and Jonatan Männchen as GHSA-6xh2-93p9-vqh4. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-48593 since 05/22/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 2.12.5 eliminates this vulnerability. Applying the patch 9998b7e284e02fdd4645dd6231760038e63b584d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-31974). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• oban-bg

Name

• oban_web

Version

• 2.12.0
• 2.12.1
• 2.12.2
• 2.12.3
• 2.12.4

License

• open-source

Website

• Product: https://github.com/oban-bg/oban_web/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion