Oban Web CVE-2026-48593

Oban Web (cpe:2.3:a:oban-bg:oban_web) is the dashboard UI component for the Oban background job framework in Elixir, running on the BEAM virtual machine. The affected module, Elixir.Oban.Web.CronExpr, parses and renders human-readable descriptions of cron schedules. The root cause (CWE-400: Uncontrolled Resource Consumption) lies in the parse_range/1 and expand_dom_parts/1 / expand_dow_parts/1 helpers, which call Integer.parse/1 on both endpoints of a cron range without validating that values fall within field-appropriate bounds (e.g., 0-59 for minutes, 1-31 for day-of-month). The downstream call to Enum.to_list/1 then eagerly materializes the full integer range into a list in memory. A sibling function, extract_dom_values, already performed correct bounds validation, but the expansion path was never wired to it. The fix (commit 9998b7e) retrofits bounds parameters into parse_field, parse_part, parse_range, and parse_value, validating both endpoints against field-specific Elixir ranges (e.g., 1..31 for DOM) and rejecting inverted or out-of-bound inputs before any expansion occurs.