Executive brief
Oban Web is a dashboard for managing background jobs in Elixir applications. A vulnerability in its cron expression parser allows an attacker to schedule a job with a specially crafted time range that consumes massive amounts of system memory. When an administrator views the dashboard, the system attempts to process this range, which can lead to a complete service outage or crash.
Technical details
A resource exhaustion vulnerability exists in oban_web due to unbounded range expansion in the cron expression parser. The `Oban.Web.CronExpr.describe/1` function calls `parse_range/1`, which uses `Integer.parse/1` on range endpoints without performing bounds checks. When the dashboard renders the cron list, `expand_dom_parts/1` or `expand_dow_parts/1` eagerly materializes these ranges into lists using `Enum.to_list/1`. An attacker with permissions to schedule cron jobs can provide a malicious range (e.g., 1-100,000,000), causing the BEAM node to allocate gigabytes of memory and crash when a dashboard user views the job list. This issue is fixed in version 2.12.5.
Affected products
- oban-bg oban_web >= 2.12.0, < 2.12.5
Timeline
- 2026-05-26: disclosed
- 2026-06-30: advisory: GitHub Advisory published
- 2026-06-30: patched: Version 2.12.5 released