CVE-2026-67585 in absinthe_federation
Summary
by MITRE • 08/07/2026
Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthe_federation allows an unauthenticated remote attacker to abort the Erlang VM via crafted _entities representation keys.
Every key of every object in the representations argument of the federation-mandated _entities field is converted with String.to_atom/1 by convert_key/2 in lib/absinthe/federation/schema/entities_field.ex. representations is typed as the open-ended _Any scalar, so its keys bypass schema coercion and the attacker names them freely. Atoms are never garbage collected and the BEAM atom table is hard-capped (about 1,048,576 entries by default), so one request carrying tens of thousands of unique keys creates that many permanent atoms and a handful of such requests exhausts the table and aborts the node. The impact is confined to availability: no data is read or altered, and recovery requires restarting the application.
This issue affects absinthe_federation: from 0.1.0 before 0.9.3.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability described represents a critical resource exhaustion flaw in the DivvyPayHQ absinthe_federation library that enables unauthenticated remote attackers to cause Erlang VM node termination through deliberate abuse of atom table allocation. This issue manifests within the _entities field processing logic where the convert_key/2 function in lib/absinthe/federation/schema/entities_field.ex performs String.to_atom/1 conversion on every key present in the representations argument without any bounds checking or resource limitations. The representations argument is typed as the open-ended _Any scalar, which bypasses normal schema coercion mechanisms and allows attackers to define arbitrary key names that are then processed through the atom conversion routine.
The technical execution of this vulnerability relies on the fundamental characteristics of Erlang's BEAM virtual machine architecture where atoms are stored in a global table that serves as a permanent identifier registry. Unlike other data types that are subject to garbage collection, atoms remain allocated in memory until the VM terminates, creating a persistent resource consumption issue. The default atom table limit of approximately 1,048,576 entries provides a finite boundary that can be easily exhausted through careful crafting of requests containing tens of thousands of unique key names. Each unique key processed through String.to_atom/1 creates a permanent atom entry in the table, and multiple such requests can quickly consume the entire available atom space.
This vulnerability directly maps to CWE-772, which addresses "Missing Release of Resource after Effective Lifetime," specifically within the context of Erlang VM atom table management. The flaw also aligns with ATT&CK technique T1499.004, "Endpoint Denial of Service," as it enables attackers to consume system resources and cause service unavailability. The operational impact is confined to availability disruption rather than data compromise or integrity violation, meaning that while the application becomes unavailable and requires manual restart for recovery, no sensitive data is accessed or modified during the attack execution.
The security implications extend beyond simple denial of service as this vulnerability can be exploited repeatedly without authentication requirements, making it particularly dangerous in production environments. Recovery from such an attack necessitates complete application restart, potentially causing extended downtime and service disruption. Organizations should implement immediate mitigations including request rate limiting, input validation on key names, and monitoring for unusual atom table consumption patterns. The vulnerability affects all versions of absinthe_federation from 0.1.0 through 0.9.2, making it a widespread concern for systems utilizing this library in their GraphQL federation implementations.