CVE-2026-78228 Unbounded handle_error recursion enables denial of service in AshOban triggers
An attacker can cause a denial of service by triggering an error in AshOban workers, leading to unbounded recursion and resource exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-78228?
CVE-2026-78228 is a medium-severity denial of service vulnerability in ash-project ash_oban, published on 30 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger's on_error action to fail on the final attempt to exhaust worker CPU and memory, denying service.
The generated worker's atomic handle_error/4 runs the trigger's on_error action on a job's final attempt inside a rescue that, when the action itself raises, calls handle_error/4 again with the same job. The job's attempt still equals max_attempts, so it re-enters the same clause and re-runs the failing action, with no exit. Any deterministic on_error failure (a data-layer outage, a misconfigured action, or a record the action rejects) loops forever; because the recursive call is not in tail position, each iteration retains a formatted stacktrace and the process heap grows without bound while the failing statement is re-issued against the data layer until the runtime kills the worker.
This issue affects ash_oban: from 0.8.0-rc.1 before 0.8.14.
Weakness: CWE-674
Which versions are affected by CVE-2026-78228?
1 open source package ship an affected version, including ash_oban.
| Package | Affected | Fixed in |
|---|---|---|
ash_oban Hex | From 0.8.0-rc.1 | 0.8.14 |
How do I fix CVE-2026-78228?
Upgrade ash_oban to 0.8.14 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-78228 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-78228 exists.
Sources
Also known as EEF-CVE-2026-78228, GHSA-94p7-498r-mrhp.