Executive brief
ash_oban is a job queue library for the Elixir framework. An uncontrolled recursion vulnerability in its error handler allows an attacker to trigger infinite loops that exhaust CPU and memory resources on worker processes, causing service outages. The flaw is reachable by any user who can configure trigger error actions.
Technical details
The vulnerability is an uncontrolled recursion in the handle_error/4 function that processes failed job attempts. When a trigger's on_error action raises an exception on the final attempt, the exception is caught by a rescue clause that calls handle_error/4 again with the same job. Since the attempt counter remains at max_attempts, execution re-enters the same code path and re-runs the failing action in a loop. The recursive call is not in tail position, causing the stack to retain formatted stacktraces and heap memory to grow unbounded with each iteration. Any deterministic failure (data layer outage, misconfigured action, rejected record) triggers an infinite loop that persists until the worker process is killed by the runtime. Attack vector is local (requires ability to configure triggers); no network access or authentication bypass is needed beyond normal application access.
Affected products
- ash-project ash_oban 0.8.0-rc.1 before 0.8.14
Timeline
- 2026-08-30: disclosed