The vulnerability is an uncontrolled resource consumption flaw that triggers memory exhaustion in the oban_web application. When a cron expression containing a large numeric range is parsed, the code materializes the range eagerly, allocating several gigabytes of memory and causing the BEAM node to stall or terminate. This can drop the web dashboard and any services relying on the node, leading to a denial‑of‑service condition for users of the application.

Vulnerable releases of oban_web range from version 2.12.0 up through 2.12.4. Any instance running one of these versions and allowing users to schedule cron jobs via the dashboard is susceptible.

The CVSS score of 5.9 denotes moderate risk, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires the ability to submit cron schedules through the dashboard, implying an actor with at least privileged or administrative access. Based on the description, the likely attack vector is internal or by a compromised administrator account. Successful exploitation would exhaust memory, degrade performance, or crash the BEAM runtime, effectively denying service to legitimate users.