CVE-2026-67585
Received Received - Intake

Allocation of Resources Without Limits or Throttling in absinthe_federation

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: EEF

Description
Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthe_federation allows an unauthenticated remote attacker to abort the Erlang VM via crafted _entities representation keys. Every key of every object in the representations argument of the federation-mandated _entities field is converted with String.to_atom/1 by convert_key/2 in lib/absinthe/federation/schema/entities_field.ex. representations is typed as the open-ended _Any scalar, so its keys bypass schema coercion and the attacker names them freely. Atoms are never garbage collected and the BEAM atom table is hard-capped (about 1,048,576 entries by default), so one request carrying tens of thousands of unique keys creates that many permanent atoms and a handful of such requests exhausts the table and aborts the node. The impact is confined to availability: no data is read or altered, and recovery requires restarting the application. This issue affects absinthe_federation: from 0.1.0 before 0.9.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-67585
EUVD
EUVD-2026-54531

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
divvypayhq absinthe_federation From 0.1.0 (inc) to 0.9.3 (exc)
absinthe_federation absinthe_federation From 0.1.0 (inc) to 0.9.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an allocation of resources without limits or throttling issue in the DivvyPayHQ absinthe_federation library. An unauthenticated remote attacker can send crafted _entities representation keys to exhaust the Erlang VM's atom table by creating tens of thousands of unique atoms. Atoms in BEAM are never garbage collected and have a hard limit of about 1,048,576 entries. This causes the node to abort, impacting availability without altering or reading data.

Detection Guidance

Monitor Erlang VM atom table usage and check for excessive unique keys in _entities requests. Use Erlang shell commands like 'erlang:memory(atom)' to track atom count and 'erlang:system_info(atom_count)' to see current usage. Inspect application logs for repeated malformed _entities queries with large key sets.

Impact Analysis

The impact is limited to availability. An attacker can cause the application to crash by exhausting the atom table, requiring a restart to recover. No data is read or altered, so confidentiality and integrity are not affected.

Compliance Impact

This vulnerability primarily impacts system availability by causing denial of service through atom table exhaustion. It does not involve data access or modification, so direct compliance violations for standards like GDPR or HIPAA are unlikely unless availability requirements are part of those standards.

Mitigation Strategies

Upgrade absinthe_federation to version 0.9.3 or later. Apply input validation to sanitize _entities keys before processing. Implement rate limiting on GraphQL endpoints to prevent large request bursts. Restart affected nodes if atom table exhaustion is suspected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67585. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart