vulnerability / NVI-00017495 / Revision 1
oban_web: Unbounded range expansion in cron describe causes memory exhaustion
GitHub lists this reviewed advisory for oban_web. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.
This report has not inspected your inventory, configuration, deployed build, reachability or evidence. A catalog listing and a severity score do not establish exposure or compromise.
01 / Meaning
Why it matters
Published affected context helps an owner decide what evidence to gather. This report has not examined your application.
02 / Applicability
The affected context
Affected versions, configuration prerequisites and known exclusions are public. Confirm each one against the deployed service.
oban_web
source listed>= 2.12.0, < 2.12.5
### Summary `oban_web` 2.12.0 introduced a cron expression parser that expands `-`-separated ranges without validating the endpoints. An attacker with access to schedule cron jobs can submit a malicious expression; when any user with dashboard access views the cron job list, `Oban.Web.CronExpr.describe/1` is called to render it, triggering allocation of gigabytes of memory and stalling or crashing the BEAM node. ### Details **1. Scheduling:** The attacker submits a cron job with a malicious expression such as `"0 0 1-100000000 * *"`. No special privilege is required beyond the ability to schedule cron jobs. **2. Parsing:** When the cron list is rendered in the dashboard, `describe/1` calls `parse_range/1` in `lib/oban/web/cron_expr.ex`, which calls `Integer.parse/1` on both endpoints of the range with no bounds check, returning `{:range, start_val, end_val}` for any integers. **3. Eager expansion:** `expand_dom_parts/1` and `expand_dow_parts/1` materialise the range via `Enum.to_list(start_val..end_val)`. The input above produces ~100 million integers (~2.4 GB). A sibling helper `extract_dom_values` already validates range bounds, but the expansion helpers do not. ### PoC 1.
03 / Response
What to do next
- investigate
Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.
Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database
A fixed release is not deployment evidence.
Check current vendor support and compatibility. After making a change, verify the deployed build and relevant runtime conditions. Keep the evidence, owner and time. An updated lockfile alone does not prove what is running.
04 / Limits
What this report cannot establish
- Customer inventory, deployment, reachability and exploitation have not been inspected.
05 / Provenance
Sources you can inspect
Each assertion retains its source. Mirrored records may repeat one underlying publisher; additional links are not independent corroboration.
- GHSA-6xh2-93p9-vqh4 ↗
GitHub Advisory Database · vendor advisory
Observed . GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.
Public revision history
Only published revisions appear here. Routine fetches do not create a material-change event.
- Revision 1 ·
First indexed by Null; source disclosure date is shown separately.