CVE-2026-67585: Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation
Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthefederation allows an unauthenticated remote attacker to abort the Erlang VM via crafted entities representation keys.
Every key of every object in the representations argument of the federation-mandated entities field is converted with String.toatom/1 by convertkey/2 in lib/absinthe/federation/schema/entitiesfield.ex. representations is typed as the open-ended Any scalar, so its keys bypass schema coercion and the attacker names them freely. Atoms are never garbage collected and the BEAM atom table is hard-capped (about 1,048,576 entries by default), so one request carrying tens of thousands of unique keys creates that many permanent atoms and a handful of such requests exhausts the table and aborts the node. The impact is confined to availability: no data is read or altered, and recovery requires restarting the application.
This issue affects absinthefederation: from 0.1.0 before 0.9.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67585?
CVE-2026-67585 has a risk rating of 68, indicating a moderate severity level.
What is CVE-2026-67585?
CVE-2026-67585 is a vulnerability in DivvyPayHQ absinthe_federation that allows an unauthenticated remote attacker to abort the Erlang VM through resource exhaustion via crafted _entities representation keys.
How do I fix CVE-2026-67585?
To mitigate CVE-2026-67585, implement rate limiting or throttling mechanisms for the _entities representation keys in your application.
Who is affected by CVE-2026-67585?
Any application using the DivvyPayHQ absinthe_federation library is potentially affected by CVE-2026-67585.
What could an attacker achieve with CVE-2026-67585?
An attacker could exploit CVE-2026-67585 to cause resource exhaustion, leading to denial of service by aborting the Erlang VM.