Junglewise Threat Intelligence

CVE-2026-48593: Oban Web memory exhaustion via unbounded cron range expansion

CVE-2026-48593 · Severity: medium · CVSS 5.9 · Published 2026-05-26

Vendors: Erlang.

Executive brief

Oban Web is a dashboard for managing background jobs in Elixir applications. A vulnerability in its cron expression parser allows an attacker to schedule a job with a specially crafted time range that consumes massive amounts of system memory. When an administrator views the dashboard, the system attempts to process this range, which can lead to a complete service outage or crash.

Technical details

A resource exhaustion vulnerability exists in oban_web due to unbounded range expansion in the cron expression parser. The `Oban.Web.CronExpr.describe/1` function calls `parse_range/1`, which uses `Integer.parse/1` on range endpoints without performing bounds checks. When the dashboard renders the cron list, `expand_dom_parts/1` or `expand_dow_parts/1` eagerly materializes these ranges into lists using `Enum.to_list/1`. An attacker with permissions to schedule cron jobs can provide a malicious range (e.g., 1-100,000,000), causing the BEAM node to allocate gigabytes of memory and crash when a dashboard user views the job list. This issue is fixed in version 2.12.5.

Affected products

  • oban-bg oban_web >= 2.12.0, < 2.12.5

Timeline

  • 2026-05-26: disclosed
  • 2026-06-30: advisory: GitHub Advisory published
  • 2026-06-30: patched: Version 2.12.5 released

References

Related threats