EEF-CVE-2026-43967
- Source
- https://cna.erlef.org/osv/EEF-CVE-2026-43967.html
- Import Source
- https://cna.erlef.org/osv/EEF-CVE-2026-43967.json
- JSON Data
- https://api.osv.dev/v1/vulns/EEF-CVE-2026-43967
- Aliases
-
- CVE-2026-43967
- GHSA-9mhv-8h52-q7q2
- Published
- 2026-05-08T15:42:34.347Z
- Modified
- 2026-05-09T04:18:14.810Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Quadratic fragment-name uniqueness check causes denial of service in absinthe
- Details
-
Summary
Inefficient Algorithmic Complexity vulnerability in absinthe-graphql absinthe allows unauthenticated denial of service via quadratic fragment-name uniqueness validation.
'Elixir.Absinthe.Phase.Document.Validation.UniqueFragmentNames':run/2 iterates over all fragments and for each one calls duplicate?/2, which evaluates Enum.count(fragments, &(&1.name == name)) — a full linear scan of the fragment list. The result is O(N²) comparisons per document, where N is the number of fragment definitions supplied by the caller.
Because input.fragments is built directly from the GraphQL query body, N is fully attacker-controlled. A minimum-size fragment definition is roughly 16 bytes, so a ~1 MB document carries ~60,000 fragments and forces ~3.6 × 10⁹ comparisons inside this single validation phase. No authentication, schema knowledge, or special configuration is required.
This issue affects absinthe: from 1.2.0 before 1.10.2.
- Database specific
{ "capec_ids": [ "CAPEC-229" ], "cpe_ids": [ "cpe:2.3:a:absinthe-graphql:absinthe:*:*:*:*:*:*:*:*" ], "cwe_ids": [ "CWE-407" ] }- References
- Credits
-
-
- Peter Ullrich - FINDER
-
- Curtis Schiewek - REMEDIATION_DEVELOPER
-
Affected packages
Hex / absinthe
Package
- Name
- absinthe
- Purl
- pkg:hex/absinthe