Which versions of absinthe are affected by CVE-2026-43967?

Absinthe GraphQL versions 1.2.0 through 1.10.1 contain an unauthenticated denial-of-service vulnerability allowing remote attackers to crash GraphQL services by sending specially crafted requests…. A patch is available.

How to fix or mitigate CVE-2026-43967?

Within 24 hours: Identify all Absinthe GraphQL deployments and document current versions via dependency manifests (mix.lock for Elixir projects). Within 7 days: Upgrade all affected instances to Absinthe version 1.10.2 or later; test in staging environment first. Within 30 days: Implement rate limiting on GraphQL query complexity and request payload size as defense-in-depth; review access logs for exploitation attempts matching the pattern (large payloads with fragment definitions).

absinthe CVE-2026-43967

Q: What is the CVSS score of CVE-2026-43967?

CVE-2026-43967 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-28800 HIGH

Inefficient Algorithmic Complexity (CWE-407)

2026-05-08 EEF

GHSA-9mhv-8h52-q7q2

Denial Of Service Absinthe

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 08, 2026 - 16:31 vuln.today

Analysis Generated

May 08, 2026 - 16:31 vuln.today

CVSS changed

May 08, 2026 - 16:22 NVD

8.7 (HIGH)

CVE Published

May 08, 2026 - 15:42 nvd

HIGH 8.7

DescriptionCVE.org

Inefficient Algorithmic Complexity vulnerability in absinthe-graphql absinthe allows unauthenticated denial of service via quadratic fragment-name uniqueness validation.

'Elixir.Absinthe.Phase.Document.Validation.UniqueFragmentNames':run/2 iterates over all fragments and for each one calls duplicate?/2, which evaluates Enum.count(fragments, &(&1.name == name)) - a full linear scan of the fragment list. The result is O(N²) comparisons per document, where N is the number of fragment definitions supplied by the caller.

Because input.fragments is built directly from the GraphQL query body, N is fully attacker-controlled. A minimum-size fragment definition is roughly 16 bytes, so a ~1 MB document carries ~60,000 fragments and forces ~3.6 × 10⁹ comparisons inside this single validation phase. No authentication, schema knowledge, or special configuration is required.

This issue affects absinthe: from 1.2.0 before 1.10.2.

AnalysisAI

Unauthenticated denial of service in absinthe-graphql versions 1.2.0 through 1.10.1 allows remote attackers to exhaust CPU resources via quadratic-complexity validation. Attackers submit GraphQL documents with tens of thousands of fragment definitions (~60,000 fragments in a 1 MB payload), triggering O(N²) comparisons during fragment-name uniqueness validation - approximately 3.6 billion comparisons per request. No authentication, schema knowledge, or special server configuration is required. Patch available in version 1.10.2 via GitHub commit 223600c (replaces nested loop with single-pass frequency map).

Technical ContextAI

Absinthe is an Elixir GraphQL server library. The vulnerability resides in the 'Elixir.Absinthe.Phase.Document.Validation.UniqueFragmentNames' module, which implements the GraphQL specification requirement that fragment names be unique within a document. The flawed implementation iterates over all fragments and for each calls duplicate?/2, which performs Enum.count(fragments, &(&1.name == name)) - a full linear scan. This nested iteration produces O(N²) time complexity, a classic CWE-407 inefficient algorithmic complexity issue. Because GraphQL permits arbitrary numbers of fragment definitions in a query (input.fragments is populated directly from the client-supplied document), attackers control N without limit. The patch (commit 223600c) replaces the nested loop with Enum.frequencies_by/2, which computes a frequency map in a single pass (O(N)), then maps over fragments once to flag duplicates - reducing complexity from quadratic to linear.

RemediationAI

Upgrade absinthe to version 1.10.2 or later, which replaces the quadratic validation algorithm with a linear-time frequency-map approach (commit 223600c520493dcaf95080af552c413099f92c9d at https://github.com/absinthe-graphql/absinthe/commit/223600c520493dcaf95080af552c413099f92c9d). Update Mix dependencies by changing mix.exs to {:absinthe, "~> 1.10.2"} and running mix deps.update absinthe, then redeploy. If immediate patching is not feasible, apply rate limiting at the HTTP layer (e.g., plug_attack or nginx limit_req) to restrict request body size (1 MB limit blocks the PoC) and per-IP request rate (e.g., 10 req/min) - trade-off: legitimate clients with large batch queries may be blocked, requiring whitelist exceptions. Fragment-count limits could be enforced via custom Absinthe middleware (reject documents with >100 fragments) but require code changes and careful tuning to avoid breaking valid use cases. No server configuration change mitigates the underlying algorithmic flaw; only the patch fully resolves it.