How severe is GHSA-6xh2-93p9-vqh4?

No CVSS score has been assigned to GHSA-6xh2-93p9-vqh4 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-6xh2-93p9-vqh4?

GHSA-6xh2-93p9-vqh4 affects the following packages: oban_web (Hex). Ecosystems affected: Hex.

How do I fix GHSA-6xh2-93p9-vqh4?

Update oban_web to 2.12.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-6xh2-93p9-vqh4 is resolved across your whole dependency graph.

How do I detect GHSA-6xh2-93p9-vqh4 in my Hex dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for oban_web. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-6xh2-93p9-vqh4 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-6xh2-93p9-vqh4?

O3 pinpoints whether GHSA-6xh2-93p9-vqh4 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-6xh2-93p9-vqh4 actively exploited in the wild?

No public exploit code has been indexed for GHSA-6xh2-93p9-vqh4 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What type of vulnerability is GHSA-6xh2-93p9-vqh4?

GHSA-6xh2-93p9-vqh4 is classified as Uncontrolled Resource Consumption (CWE-400). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was GHSA-6xh2-93p9-vqh4 published, and has it been updated?

GHSA-6xh2-93p9-vqh4 was published on June 30, 2026 and was last updated on June 30, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

💧 Hex

Not in CISA KEV

GHSA-6xh2-93p9-vqh4

Fix: oban-bg/oban_web@9998b7e

GHSA-6xh2-93p9-vqh4 is a Uncontrolled Resource Consumption vulnerability in oban_web. O3 Security confirms whether GHSA-6xh2-93p9-vqh4 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

oban_web: Unbounded range expansion in cron describe causes memory exhaustion

Also known asCVE-2026-48593EEF-CVE-2026-48593

Published

Jun 30, 2026

Updated

Jun 30, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Jun 30, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-6xh2-93p9-vqh4.

Real-World Exposure

1 pkg affected

💧oban_web

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Hex packages — download data is not available via public APIs for these ecosystems.

Description

Summary

oban_web 2.12.0 introduced a cron expression parser that expands --separated ranges without validating the endpoints. An attacker with access to schedule cron jobs can submit a malicious expression; when any user with dashboard access views the cron job list, Oban.Web.CronExpr.describe/1 is called to render it, triggering allocation of gigabytes of memory and stalling or crashing the BEAM node.

Details

1. Scheduling: The attacker submits a cron job with a malicious expression such as "0 0 1-100000000 * *". No special privilege is required beyond the ability to schedule cron jobs.

2. Parsing: When the cron list is rendered in the dashboard, describe/1 calls parse_range/1 in lib/oban/web/cron_expr.ex, which calls Integer.parse/1 on both endpoints of the range with no bounds check, returning {:range, start_val, end_val} for any integers.

3. Eager expansion: expand_dom_parts/1 and expand_dow_parts/1 materialise the range via Enum.to_list(start_val..end_val). The input above produces ~100 million integers (~2.4 GB). A sibling helper extract_dom_values already validates range bounds, but the expansion helpers do not.

PoC

Schedule a cron job with expression "0 0 1-100000000 * *" (or any expression with an out-of-domain range).
Have any user with Oban.Web dashboard access navigate to the cron job list.
The dashboard calls describe/1 to render the expression, exhausting BEAM memory and crashing the node.

Impact

CVSS 4.0 score 5.9 (Medium). Affects oban_web >= 2.12.0. Requires the ability to schedule a cron job and a dashboard user to view the cron list; no further privileges are needed.

References

Introduction commit: https://github.com/oban-bg/oban_web/commit/a97c7960bb389b05aaab4cf8042985f02ceddc24
Patch commit: https://github.com/oban-bg/oban_web/commit/9998b7e284e02fdd4645dd6231760038e63b584d

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
💧Hex	`oban_web`	≥ 2.12.0&&< 2.12.5	2.12.5

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for oban_web. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update oban_web to 2.12.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-6xh2-93p9-vqh4 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-6xh2-93p9-vqh4 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-6xh2-93p9-vqh4. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Summary `oban_web` 2.12.0 introduced a cron expression parser that expands `-`-separated ranges without validating the endpoints. An attacker with access to schedule cron jobs can submit a malicious expression; when any user with dashboard access views the cron job list, `Oban.Web.CronExpr.describe/1` is called to render it, triggering allocation of gigabytes of memory and stalling or crashing the BEAM node. ### Details **1. Scheduling:** The attacker submits a cron job with a malicious expression such as `"0 0 1-100000000 * *"`. No special privilege is required beyond the ability to sc

O3 Security · Impact-Aware SCA

Is GHSA-6xh2-93p9-vqh4 in your dependencies?

O3 detects GHSA-6xh2-93p9-vqh4 across Hex dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works