CVE-2026-48593: Oban Web Memory Exhaustion DoS Vulnerability

CVE-2026-48593 Overview

CVE-2026-48593 is an uncontrolled resource consumption vulnerability ([CWE-400]) in the oban_web library for Elixir, specifically within the Elixir.Oban.Web.CronExpr modules. An authenticated attacker with permission to schedule cron jobs can submit a crafted cron expression containing an unbounded numeric range. When a dashboard user later renders the cron job list, the range is eagerly materialised, consuming approximately 2.4 GB of memory and stalling or crashing the BEAM virtual machine. The flaw affects oban_web versions from 2.12.0 through 2.12.4 and is fixed in 2.12.5.

Critical Impact
A single malicious cron expression such as "0 0 1-100000000 * *" is sufficient to exhaust memory and take down the Erlang/Elixir node hosting the Oban Web dashboard.

Affected Products

oban_web versions 2.12.0 through 2.12.4
Elixir applications embedding the Oban Web dashboard
BEAM nodes rendering attacker-controlled cron expressions

Discovery Timeline

2026-05-26 - CVE-2026-48593 published to the National Vulnerability Database (NVD)
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-48593

Vulnerability Analysis

The defect resides in how oban_web parses and expands cron range tokens for display. When the dashboard renders the cron job list, Elixir.Oban.Web.CronExpr.describe/1 is invoked to produce a human-readable representation of the schedule. The describe path calls parse_range/1, which uses Integer.parse/1 on each endpoint of a numeric range without validating the resulting magnitude.

Downstream helpers expand_dom_parts/1 and expand_dow_parts/1 then eagerly materialise the parsed range using Enum.to_list/1. Submitting a range such as 1-100000000 causes the BEAM scheduler to allocate a 100-million-element list, consuming roughly 2.4 GB of memory per render. The result is denial of service against any node viewing the affected schedule.

Root Cause

The root cause is missing bounds validation in the range expansion path. A sibling helper, extract_dom_values, already enforces sane upper limits on range endpoints, but parse_range/1 and its consumers do not share that validation. The asymmetry between the two code paths allows attacker-controlled integers to flow unchecked into list materialisation.

Attack Vector

Exploitation requires an attacker account with permission to schedule Oban cron jobs (low privileges) and a separate dashboard user who views the cron list, triggering the render. The attacker submits a cron expression with an oversized numeric range in the day-of-month or day-of-week field. When the dashboard renders the entry, the BEAM node hosting oban_web allocates gigabytes of memory and stalls, producing denial of service for the application and any tenants sharing the node.

The vulnerability is described in detail in the GitHub Security Advisory GHSA-6xh2-93p9-vqh4 and the Erlang Ecosystem Foundation CNA advisory.

Detection Methods for CVE-2026-48593

Indicators of Compromise

Sudden BEAM memory spikes into the multi-gigabyte range correlated with dashboard requests to the Oban Web cron view
Crash dumps or eheap_alloc allocation failures from the Erlang runtime shortly after a new cron job is scheduled
Cron job entries in the Oban database containing numeric ranges with unusually large endpoints in the day-of-month or day-of-week fields

Detection Strategies

Query the Oban jobs and cron configuration tables for expressions matching ranges with endpoints greater than typical cron values (for example, day-of-month above 31 or day-of-week above 7)
Alert on BEAM VM telemetry events showing total_heap_size or memory_total growth that exceeds baseline by more than an order of magnitude
Correlate authenticated cron scheduling actions in application audit logs with subsequent dashboard render errors or process restarts

Monitoring Recommendations

Instrument the Elixir application with :telemetry handlers on Oban Web dashboard render events and emit metrics for render duration and memory delta
Monitor container or host memory utilisation for the application and configure alerts at 70 percent and 90 percent thresholds
Forward Erlang crash dumps and SASL reports to a central logging system for review of out_of_memory terminations

How to Mitigate CVE-2026-48593

Immediate Actions Required

Upgrade oban_web to version 2.12.5 or later in mix.exs and redeploy the application
Audit existing cron job definitions for malformed or oversized range expressions and remove or correct them before re-rendering the dashboard
Restrict cron scheduling permissions to a minimal set of trusted operator accounts until the upgrade is complete

Patch Information

The maintainers addressed the issue in the upstream commit 9998b7e284e02fdd4645dd6231760038e63b584d, which adds bounds validation to the range expansion helpers so that oversized endpoints are rejected before list materialisation. The fix is included in release 2.12.5. See also the OSV record EEF-CVE-2026-48593.

Workarounds

Place the Oban Web dashboard behind an authenticated reverse proxy that limits access to administrative networks
Add an application-level validation layer that rejects cron expressions whose numeric tokens exceed standard field maxima (59, 23, 31, 12, 7) before they are persisted
Run the BEAM node with a constrained memory cgroup so that allocation failures terminate only the affected worker rather than starving co-located services

bash

# Configuration example: pin oban_web to the patched version in mix.exs
# {:oban_web, "~> 2.12.5"}
mix deps.update oban_web
mix deps.get
mix compile