ash_oban CVE-2026-78228

Three concurrent conditions are required for exploitation: (1) ash_oban 0.8.0-rc.1 through 0.8.13 must be deployed and the affected worker module must be compiled and running; (2) at least one trigger must be configured with an on_error action - triggers without on_error are not affected; and (3) the on_error action must raise deterministically when invoked on a final-attempt job, which can be caused by a data-layer outage, a required action argument being absent or invalid, or a record that fails the action's validations. The CVSS 4.0 AT:P modifier confirms this partial-presence requirement. Exploitation is limited by: the necessity of an on_error action being configured (an optional feature), the requirement that the action failure is deterministic rather than transient (a transient failure will resolve and exit the recursion only if the process is killed first), and the scope being bounded to the specific worker process rather than the broader application. No special network position or privileged system access is confirmed required based on the provided CVSS PR:N, though the ability to submit data that influences on_error action behavior may require application-level authentication depending on deployment.

The CVSS 4.0 score of 5.9 with vector AV:L/AC:L/AT:P/PR:N/UI:N reflects a purely availability impact (VA:H) bounded to the vulnerable worker process, with no confidentiality or integrity exposure and no subsequent-system impact. The AT:P modifier is analytically important: exploitation is conditional on an on_error action that deterministically fails, which requires either a misconfigured action, a data-layer outage coinciding with a final-attempt job, or user-submitted data that the action rejects - not a trivially reproducible attack from a cold start. Data-layer outages are operationally common, however, so the precondition can arise without adversarial intent. Even a mid-sized municipal IT team in rybnik running ash_oban-backed background processing would face queue starvation if a database disruption coincides with final-attempt jobs. No EPSS data is available in the provided input and there is no CISA KEV entry, indicating no confirmed widespread or targeted exploitation at time of analysis. EPSS absence means automated exploitation probability cannot be quantified; this should be treated as a data gap rather than a signal of low risk. The CVSS AV:L designation may understate network-reachable attack paths if application users can submit records that trigger the on_error condition remotely; defenders should verify whether their on_error actions process externally influenced data.

An Oban worker processes a job that has consumed all retry attempts. The job's configured on_error action attempts a data-layer update, but the database is returning errors due to an outage or a record constraint violation. The action raises inside the rescue block, causing handle_error/4 to call itself recursively with the original job; each recursive call retains the BEAM stacktrace and re-issues the failing database statement, growing the process heap without bound until the BEAM runtime kills the worker and the queue slot is blocked indefinitely.