PT-2026-43408 · Oban Web · Oban Web

Jonatan Männchen + 2 · Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-48593

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions oban web versions 2.12.0 through 2.12.4

Description Uncontrolled Resource Consumption in the Elixir.Oban.Web.CronExpr module allows memory exhaustion through unbounded cron range expansion. An attacker with permissions to schedule cron jobs can submit a malicious cron expression. When a user with dashboard access views the cron job list, the describe/1 function is called to render the expression. The parse range/1 function parses range endpoints using Integer.parse/1 without bounds checks, and the expand dom parts/1 and expand dow parts/1 helpers eagerly materialize the range via Enum.to list/1. This process can lead to the allocation of approximately 2.4 GB of memory, resulting in the stalling or crashing of the BEAM node (the Erlang Virtual Machine).

Recommendations Update oban web to version 2.12.5.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-48593

GHSA-6XH2-93P9-VQH4

Affected Products

Oban Web

References · 6

• https://github.com/oban-bg/oban_web/security/advisories/GHSA-6xh2-93p9-vqh4 · Vendor Advisory
• https://github.com/oban-bg/oban_web/commit/9998b7e284e02fdd4645dd6231760038e63b584d · Patch
• https://osv.dev/vulnerability/EEF-CVE-2026-48593 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48593 · Security Note
• https://cna.erlef.org/cves/CVE-2026-48593.html · Note
• https://hex.pm/packages/oban_web · Note