CVE-2026-42793

Name of the Vulnerable Software and Affected Versions absinthe versions 1.5.0 through 1.10.1

Description An unauthenticated denial of service can occur via atom table exhaustion when parsing attacker-controlled GraphQL SDL. Multiple Blueprint.Draft.convert/2 implementations in the SDL language modules call String.to atom/1 on attacker-controlled names, such as directive, field, type, and argument names. Since atoms are not garbage-collected and the BEAM atom table has a fixed limit, submitting SDL documents with numerous unique names can exhaust the table, causing the Erlang VM to abort with a system limit and crashing the entire node. Applications passing attacker-controlled GraphQL SDL through the parser, such as schema-upload endpoints or federation gateways ingesting remote SDL, are exposed.

Recommendations Update to version 1.10.2.