ash_oban is vulnerable to Uncontrolled Recursion
59
Medium Risk
The worker generated in define_schedulers.ex runs a trigger's on_error action on a job's final attempt inside a rescue clause. When that action deterministically fails, the rescue re-invokes the same error handler with the unchanged job, and because the call is not in tail position each frame retains a freshly formatted stacktrace. This produces unbounded recursion that consumes CPU, database load, and process memory until the worker is killed, denying service. The fix reraises the error instead of recursively retrying the failing on_error action.
You are affected if you are using a version that falls within the vulnerable range and you use a trigger whose on_error action can be driven to fail deterministically on a job's final attempt.
ash_oban is vulnerable to Uncontrolled Recursion in versions 0.8.0 - 0.8.13.
Upgrade the ash_oban library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.