CVE-2026-78228
Received Received - Intake

Uncontrolled Recursion in ash_oban Leading to DoS

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: EEF

Description
Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger's on_error action to fail on the final attempt to exhaust worker CPU and memory, denying service. The generated worker's atomic handle_error/4 runs the trigger's on_error action on a job's final attempt inside a rescue that, when the action itself raises, calls handle_error/4 again with the same job. The job's attempt still equals max_attempts, so it re-enters the same clause and re-runs the failing action, with no exit. Any deterministic on_error failure (a data-layer outage, a misconfigured action, or a record the action rejects) loops forever; because the recursive call is not in tail position, each iteration retains a formatted stacktrace and the process heap grows without bound while the failing statement is re-issued against the data layer until the runtime kills the worker. This issue affects ash_oban: from 0.8.0-rc.1 before 0.8.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-78228
EUVD
EUVD-2026-68186

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_oban From 0.8.0-rc.1 (inc) to 0.8.14 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an uncontrolled recursion issue in the ash_oban library where a failing on_error action in a trigger causes infinite retries. The handle_error/4 function recursively calls itself without bound when the on_error action fails deterministically, such as due to a data-layer outage or misconfiguration. Each recursive call retains stack traces and grows the process heap, leading to CPU and memory exhaustion until the runtime kills the worker.

Detection Guidance

Detecting this vulnerability requires checking if your system runs vulnerable versions of ash_oban (0.8.0-rc.1 to 0.8.13). Inspect Elixir dependencies in mix.exs or rebar.config for ash_oban. Monitor worker processes for high CPU or memory usage during error handling. Check logs for repeated on_error action failures or infinite retry loops in Oban jobs.

Impact Analysis

This vulnerability can cause denial of service by exhausting CPU and memory resources of the worker process. An attacker who can drive a trigger's on_error action can force it to fail repeatedly on the final job attempt, triggering infinite recursion. This leads to system slowdowns or crashes, disrupting services dependent on ash_oban.

Compliance Impact

This vulnerability primarily impacts system availability by causing CPU and memory exhaustion through infinite recursion. While it does not directly violate GDPR or HIPAA, it could indirectly affect compliance by disrupting data processing systems that handle personal or health data, potentially leading to service unavailability or data processing delays.

Mitigation Strategies

Upgrade ash_oban to version 0.8.14 or later immediately. If upgrading is not possible, disable affected triggers' on_error actions or modify them to avoid deterministic failures. Restart Oban workers to clear any ongoing infinite loops. Review and adjust job retry policies to limit resource exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78228. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart