The vulnerability arises from the lack of bounds checking in the parse_range/1 function used by the describe/1 function in Elixir.Oban.Web.CronExpr. An attacker can submit a cron expression with an extremely large range (e.g., "0 0 1-100000000 * *"), which is eagerly expanded into a large list via Enum.to_list/1, causing uncontrolled memory consumption and potential denial of service. Although a related helper function extract_dom_values performs range validation, the expansion helpers do not, leading to this flaw. The issue affects oban_web versions starting at 2.12.0 up to but not including 2.12.5.

Successful exploitation can cause the BEAM node running oban_web to stall or crash due to memory exhaustion from unbounded cron range expansion. This results in denial of service for users relying on the oban_web dashboard. The vulnerability requires the attacker to have permission to schedule cron jobs and for a user with dashboard access to view the malicious cron job list, which triggers the resource exhaustion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor permissions to schedule cron jobs to trusted users only, and limit dashboard access to prevent triggering the resource exhaustion. Avoid viewing cron job lists containing untrusted or suspicious cron expressions.