CVE-2026-48593 json
Unbounded range expansion in cron describe causes memory exhaustion in oban_web
published 2026-05-26 5 mo ago modified 2026-09-08 2 mo ago also EEF-CVE-2026-48593 , GHSA-6xh2-93p9-vqh4 , EUVD-2026-31974
- cvss
- 5.9
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
Uncontrolled Resource Consumption vulnerability in oban-bg oban_web ('Elixir.Oban.Web.CronExpr' modules) allows memory exhaustion via unbounded cron range expansion.
An attacker with access to schedule cron jobs can submit a malicious cron expression such as "0 0 1-100000000 * *". When a user with dashboard access views the cron job list, 'Elixir.Oban.Web.CronExpr':describe/1 is called to render the expression. parse_range/1 parses both range endpoints via Integer.parse/1 with no bounds check, and the downstream helpers expand_dom_parts/1 and expand_dow_parts/1 materialise the range eagerly via Enum.to_list/1, causing allocation of ~2.4 GB and stalling or crashing the BEAM node. A sibling helper extract_dom_values already validates range bounds, but the expansion helpers do not.
This issue affects oban_web: from 2.12.0 before 2.12.5.
Patch / fix
- hex oban_web 2.12.5
- oban-bg oban_web 2.12.5
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 5.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hex | oban_web | >=2.12.0, <2.12.5 |
2.12.5 |
Affected products
- oban-bg oban_web
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/oban-bg/oban_web/commit/9998b7e284e02fdd4645dd6231760038e63b584d
patch, web
-
github.com
/oban-bg/oban_web/commit/a97c7960bb389b05aaab4cf8042985f02ceddc24
web
-
github.com
/oban-bg/oban_web/security/advisories/GHSA-6xh2-93p9-vqh4
vendor-advisory, related, web, advisory
-
cna.erlef.org
/cves/CVE-2026-48593.html
related, web
-
osv.dev
/vulnerability/EEF-CVE-2026-48593
related, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-48593
advisory
-
github.com
/oban-bg/oban_web
package
-
hex.pm
/packages/oban_web
package
Sources
- CVE List CVE-2026-48593
- GitHub Advisory GHSA-6xh2-93p9-vqh4
- NVD CVE-2026-48593
- OSV EEF-CVE-2026-48593
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.