CVE-2026-78228

Name of the Vulnerable Software and Affected Versions ash oban versions 0.8.0-rc.1 through 0.8.13

Description An uncontrolled recursion issue exists where a user can cause a trigger's on error action to fail on its final attempt, leading to the exhaustion of worker CPU and memory, which results in a denial of service. This occurs because the handle error/4 function runs the on error action within a rescue block; if the action raises an error, handle error/4 is called again with the same job. Since the job attempt count remains equal to the maximum attempts, the process enters an infinite loop. Because the recursive call is not in tail position, the process heap grows indefinitely as each iteration retains a formatted stacktrace until the runtime terminates the worker. This requires a trigger to declare an on error action and run through the atomic worker branch.

Recommendations Update ash oban to version 0.8.14.