Uncontrolled recursion in the ash-project ash_oban's handle_error/4 routine causes an infinite loop when an on_error action itself fails on the final retry attempt, leading to unbounded growth in the worker’s process heap and eventual termination. This results in denial of service, as the affected worker crashes and the job processing thread is lost. The flaw is identified as CWE‑674 Uncontrolled Recursion.

The vulnerability affects the AshOban library from ash-project version 0.8.0‑rc.1 up through, but not including, 0.8.14. The issue is present in both listed product entries for ash-project ash_oban.

The CVSS score of 5.9 indicates moderate impact, while the EPSS score is not available and the vulnerability is not listed in KEV, suggesting a low- to moderate-level exploitation probability. The likely attack vector requires an attacker who can manipulate a trigger’s on_error action to raise an exception, which then recursively invokes handle_error/4. Because the recursive call is not tail‑positioned, each invocation consumes stack space, and the worker will run until the runtime kills it. Exploitation would deny service to all jobs handled by the compromised worker.