Uncontrolled Resource Consumption in oban_web Product by oban-bg

CVE-2026-48593

What is CVE-2026-48593?

A vulnerability in the oban_web component allows attackers to exploit unbounded cron range expansions, leading to significant memory exhaustion. By submitting malicious cron expressions, such as '0 0 1-100000000 * *', an attacker can induce the rendering process to allocate large amounts of memory, potentially crashing the BEAM node. The issue arises from the lack of bounds checks within the parsing and expansion logic of cron expressions, despite existing validations elsewhere. Users are advised to check for updates and apply patches to mitigate this risk.

References