Doruk Gurleyen

**Name of the Vulnerable Software and Affected Versions** absinthe federation versions 0.1.0 through 0.9.2 **Description** An unauthenticated remote attacker can cause the Erlang VM to abort by sending crafted representation keys within the ` entities` field. The `convert key/2` function in `lib/absinthe/federation/schema/entities field.ex` uses `String.to atom/1` to convert every key of every object in the `representations` argument. Because `representations` is typed as an open-ended ` Any` scalar, keys bypass schema coercion. Since atoms are not garbage collected and the BEAM atom table has a hard limit of approximately 1,048,576 entries, a small number of requests containing thousands of unique keys can exhaust the table and crash the node. This issue impacts availability, requiring an application restart for recovery, but does not allow for data reading or alteration. **Recommendations** Update absinthe federation to version 0.9.3 or later.