CVE-2026-48593 Details
Description
Uncontrolled Resource Consumption vulnerability in oban-bg oban_web ('Elixir.Oban.Web.CronExpr' modules) allows memory exhaustion via unbounded cron range expansion. An attacker with access to schedule cron jobs can submit a malicious cron expression such as "0 0 1-100000000 * *". When a user with dashboard access views the cron job list, 'Elixir.Oban.Web.CronExpr':describe/1 is called to render the expression. parse_range/1 parses both range endpoints via Integer.parse/1 with no bounds check, and the downstream helpers expand_dom_parts/1 and expand_dow_parts/1 materialise the range eagerly via Enum.to_list/1, causing allocation of ~2.4 GB and stalling or crashing the BEAM node. A sibling helper extract_dom_values already validates range bounds, but the expansion helpers do not. This issue affects oban_web: from 2.12.0 before 2.12.5.
A vulnerability allowing uncontrolled resource consumption has been identified in the Oban Web package, specifically in versions 2.12.0 prior to 2.12.5. This vulnerability arises from unbounded expansion of cron range inputs, which can be exploited to cause memory exhaustion. An attacker with the ability to schedule cron jobs can submit a malicious cron expression, such as '0 0 1-100000000 * *'. When a user with dashboard access views the cron job list, the application processes the expression without proper validation, leading to excessive memory allocation of approximately 2.4 GB. This unregulated expansion stalls or crashes the BEAM node, disrupting service. The issue is rooted in the cron expression parser, which introduced the flaw by failing to validate range endpoints before processing.
Users can upgrade to Oban Web version 2.12.5 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 26, 2026CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-48593.html | EEF | AdvisoryBundle |
| https://github.com/oban-bg/oban_web/commit/9998b7e284e02fdd4645dd6231760038e63b584d | EEF | Source CodeVendor |
| https://github.com/oban-bg/oban_web/security/advisories/GHSA-6xh2-93p9-vqh4 | EEF | AdvisoryExploitRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-48593 | EEF | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | EEF |
Affected Products
| Product | Versions |
|---|---|
| oban-bg oban_web | >= 2.12.0, < 2.12.5 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | EEF |