CVE-2026-78228

Uncontrolled Recursion vulnerability in ash-project ashoban allows a user who can drive a trigger's onerror action to fail on the final attempt to exhaust worker CPU and memory, denying service. The generated worker's atomic handleerror/4 runs the trigger's onerror action on a job's final attempt...

EEF-CVE-2026-78228 Unbounded handle_error recursion enables denial of service in AshOban triggers

Summary Uncontrolled Recursion vulnerability in ash-project ashoban allows a user who can drive a trigger's onerror action to fail on the final attempt to exhaust worker CPU and memory, denying service. The generated worker's atomic handleerror/4 runs the trigger's onerror action on a job's final...

CVE-2026-78228

CVE-2026-78228 is an uncontrolled recursion vulnerability in ash_oban (ash-project), affecting versions from 0.8.0-rc.1 before 0.8.14 . The root cause lies in the generated worker's atomic handle_error/4 function: when a trigger's on_error action raises on a job's final attempt, the rescue clause...

CVE-2026-78228 Unbounded handle_error recursion enables denial of service in AshOban triggers

Uncontrolled Recursion vulnerability in ash-project ashoban allows a user who can drive a trigger's onerror action to fail on the final attempt to exhaust worker CPU and memory, denying service. The generated worker's atomic handleerror/4 runs the trigger's onerror action on a job's final attempt...

CVE-2026-78228 Unbounded handle_error recursion enables denial of service in AshOban triggers

Uncontrolled Recursion vulnerability in ash-project ashoban allows a user who can drive a trigger's onerror action to fail on the final attempt to exhaust worker CPU and memory, denying service. The generated worker's atomic handleerror/4 runs the trigger's onerror action on a job's final attempt...