Absinthe Federation
Monthly
Unauthenticated remote denial-of-service in absinthe_federation 0.1.0-0.9.2 allows an attacker to permanently exhaust the BEAM (Erlang VM) atom table and crash the application node by sending crafted GraphQL `_entities` queries with large numbers of unique representation keys. The `convert_key/2` function in `entities_field.ex` unconditionally calls `String.to_atom/1` on all client-supplied keys, bypassing schema coercion through the open-ended `_Any` scalar; since BEAM atoms are never garbage collected and the atom table is hard-capped at approximately 1,048,576 entries, a handful of requests carrying tens of thousands of unique keys exhausts the table and aborts the node. No public exploit code or CISA KEV listing exists at time of analysis, but the attack mechanism is well-understood in the Erlang ecosystem and trivially automatable.
Unauthenticated remote denial-of-service in absinthe_federation 0.1.0-0.9.2 allows an attacker to permanently exhaust the BEAM (Erlang VM) atom table and crash the application node by sending crafted GraphQL `_entities` queries with large numbers of unique representation keys. The `convert_key/2` function in `entities_field.ex` unconditionally calls `String.to_atom/1` on all client-supplied keys, bypassing schema coercion through the open-ended `_Any` scalar; since BEAM atoms are never garbage collected and the atom table is hard-capped at approximately 1,048,576 entries, a handful of requests carrying tens of thousands of unique keys exhausts the table and aborts the node. No public exploit code or CISA KEV listing exists at time of analysis, but the attack mechanism is well-understood in the Erlang ecosystem and trivially automatable.