Threat Intelligence Database

CVE-2026-78228 is an uncontrolled recursion vulnerability in the ash-project's ash_oban component. It occurs when a user's on_error trigger action fails on the final job attempt, causing infinite recursion that exhausts CPU and memory, leading to denial of service. The issue affects versions from 0.8.0-rc.1 up to but not including 0.8.14. The vulnerability results from a recursive call to handle_error/4 that is not in tail position, causing unbounded memory growth and eventual worker process termination.

CVE-2026-78038 is a medium severity vulnerability in ash-project's ash_oban component that allows improper modification of dynamically-determined object attributes. The flaw arises because user input passed to the :args option of AshOban.build_trigger/3 can override trusted job arguments due to JSON key handling, enabling an attacker to retarget update or destroy triggers at other records, potentially crossing tenant boundaries. This breaks authorization and tenant isolation assumptions. The vulnerability affects versions from 0.2.5 up to but not including 0.8.14.