CVE-2026-67585

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-67585
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67585.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-67585
Aliases
Published
2026-08-07T16:42:22.653Z
Modified
2026-08-09T03:47:27.913833255Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation
Details

Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthe_federation allows an unauthenticated remote attacker to abort the Erlang VM via crafted _entities representation keys.

Every key of every object in the representations argument of the federation-mandated entities field is converted with String.toatom/1 by convertkey/2 in lib/absinthe/federation/schema/entitiesfield.ex. representations is typed as the open-ended _Any scalar, so its keys bypass schema coercion and the attacker names them freely. Atoms are never garbage collected and the BEAM atom table is hard-capped (about 1,048,576 entries by default), so one request carrying tens of thousands of unique keys creates that many permanent atoms and a handful of such requests exhausts the table and aborts the node. The impact is confined to availability: no data is read or altered, and recovery requires restarting the application.

This issue affects absinthe_federation: from 0.1.0 before 0.9.3.

Database specific 
{
    "cna_assigner": "EEF",
    "cwe_ids": [
        "CWE-770"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "640a234a26b2d6fe5d9d21e00e5f4fce5645c0bf"
                },
                {
                    "fixed": "c3838cda2a7f65c4893291668c223b0d6acf4516"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67585.json"
}
References

Affected packages

Git / github.com/divvypayhq/absinthe_federation

Affected ranges

Type
GIT
Repo
https://github.com/divvypayhq/absinthe_federation
Events
Introduced
2587b230b91fb0e1e22d747014f9b44d0e3bef2d
Fixed
c3838cda2a7f65c4893291668c223b0d6acf4516
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.1.0"
        },
        {
            "fixed": "0.9.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.2.51
v0.2.52
v0.2.53
v0.3.0
v0.3.1
v0.3.2
v0.4.1
v0.4.2
v0.5.0
v0.5.2
v0.5.3
v0.5.4
v0.6.0
v0.6.1
v0.7.0
v0.7.1
v0.8.0
v0.9.0
v0.9.1
v0.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67585.json"