Uncontrolled Recursion in ash_oban Affects ash-project

CVE-2026-78228

What is CVE-2026-78228?

The vulnerability in ash_oban allows an attacker utilizing the on_error action to trigger an uncontrolled recursion scenario. This leads to the exhaustion of CPU and memory resources as the system continuously re-attempts the failed job without an exit condition. Each failure retains a stack trace, resulting in significant resource consumption and ultimately denying service availability. The affected versions of ash_oban are from 0.8.0-rc.1 to 0.8.14, emphasizing the need for timely patching and upgrades.

References