Intel

AIKIDO-2026-513228

ash_oban is vulnerable to Uncontrolled Recursion

Uncontrolled RecursionCVE-2026-78228 Published Yesterday

59

Medium Risk

This Affects:

ELIXIRash_oban
0.8.0 - 0.8.13
Fixed in 0.8.14
Are you affected? Scan for Free

TL;DR

The worker generated in define_schedulers.ex runs a trigger's on_error action on a job's final attempt inside a rescue clause. When that action deterministically fails, the rescue re-invokes the same error handler with the unchanged job, and because the call is not in tail position each frame retains a freshly formatted stacktrace. This produces unbounded recursion that consumes CPU, database load, and process memory until the worker is killed, denying service. The fix reraises the error instead of recursively retrying the failing on_error action.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use a trigger whose on_error action can be driven to fail deterministically on a job's final attempt.

Background info

ash_oban is vulnerable to Uncontrolled Recursion in versions 0.8.0 - 0.8.13.

How to fix this

Upgrade the ash_oban library to the patch version.

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform