EEF-CVE-2026-48593
- Source
- https://cna.erlef.org/osv/EEF-CVE-2026-48593.html
- Import Source
- https://cna.erlef.org/osv/EEF-CVE-2026-48593.json
- JSON Data
- https://api.osv.dev/v1/vulns/EEF-CVE-2026-48593
- Aliases
-
- CVE-2026-48593
- GHSA-6xh2-93p9-vqh4
- Published
- 2026-05-26T19:46:43.980Z
- Modified
- 2026-05-27T16:00:12.846887439Z
- Severity
-
- 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Unbounded range expansion in cron describe causes memory exhaustion in oban_web
- Details
-
Summary
Uncontrolled Resource Consumption vulnerability in oban-bg oban_web ('Elixir.Oban.Web.CronExpr' modules) allows memory exhaustion via unbounded cron range expansion.
An attacker with access to schedule cron jobs can submit a malicious cron expression such as "0 0 1-100000000 * *". When a user with dashboard access views the cron job list, 'Elixir.Oban.Web.CronExpr':describe/1 is called to render the expression. parserange/1 parses both range endpoints via Integer.parse/1 with no bounds check, and the downstream helpers expanddomparts/1 and expanddowparts/1 materialise the range eagerly via Enum.tolist/1, causing allocation of ~2.4 GB and stalling or crashing the BEAM node. A sibling helper extractdomvalues already validates range bounds, but the expansion helpers do not.
This issue affects oban_web: from 2.12.0 before 2.12.5.
Configuration
The vulnerability is exploitable when an attacker with access to schedule cron jobs submits a malicious cron expression. The crash is triggered when a user with dashboard access views the cron job list, which calls 'Elixir.Oban.Web.CronExpr':describe/1 to render the expression.
- Database specific
{ "cpe_ids": [ "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*" ], "capec_ids": [ "CAPEC-130" ], "cwe_ids": [ "CWE-400" ] }- References
- Credits
-
-
- Peter Ullrich - FINDER
-
- Shannon Selbert - REMEDIATION_DEVELOPER
-
- Jonatan Männchen / EEF - ANALYST
-
Affected packages
Hex / oban_web
Package
- Name
- oban_web
- Purl
- pkg:hex/oban_web