CVE-2026-78228: CWE-674 Uncontrolled Recursion in ash-project ash_oban

This vulnerability in ash_oban arises because the worker's atomic handle_error/4 function runs the on_error action on a job's final attempt inside a rescue block. If the on_error action itself raises an error, handle_error/4 is called recursively with the same job and attempt count, re-entering the same failing clause indefinitely. Since the recursive call is not tail-recursive, each iteration accumulates stack traces and grows the process heap, eventually exhausting system resources and causing a denial of service. This affects ash_oban versions from 0.8.0-rc.1 before 0.8.14.

An attacker who can cause the on_error trigger action to fail on the final job attempt can induce infinite recursion, leading to exhaustion of CPU and memory resources on the worker process. This results in denial of service by crashing the worker. The vulnerability does not require privileges or user interaction but does require the ability to drive the on_error action to fail deterministically.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Users should monitor vendor communications for patches addressing this uncontrolled recursion issue in ash_oban versions before 0.8.14.