CVE-2026-67585

Name of the Vulnerable Software and Affected Versions absinthe federation versions 0.1.0 through 0.9.2

Description An unauthenticated remote attacker can cause the Erlang VM to abort by sending crafted representation keys within the entities field. The convert key/2 function in lib/absinthe/federation/schema/entities field.ex uses String.to atom/1 to convert every key of every object in the representations argument. Because representations is typed as an open-ended Any scalar, keys bypass schema coercion. Since atoms are not garbage collected and the BEAM atom table has a hard limit of approximately 1,048,576 entries, a small number of requests containing thousands of unique keys can exhaust the table and crash the node. This issue impacts availability, requiring an application restart for recovery, but does not allow for data reading or alteration.

Recommendations Update absinthe federation to version 0.9.3 or later.