CVE-2026-67585 Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation
Unauthenticated attackers can crash the Erlang VM by exhausting the atom table via crafted GraphQL federation keys in absinthe_federation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-67585?
CVE-2026-67585 is a high-severity denial of service vulnerability in DivvyPayHQ absinthe_federation, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthe_federation allows an unauthenticated remote attacker to abort the Erlang VM via crafted _entities representation keys.
Every key of every object in the representations argument of the federation-mandated _entities field is converted with String.to_atom/1 by convert_key/2 in lib/absinthe/federation/schema/entities_field.ex. representations is typed as the open-ended _Any scalar, so its keys bypass schema coercion and the attacker names them freely. Atoms are never garbage collected and the BEAM atom table is hard-capped (about 1,048,576 entries by default), so one request carrying tens of thousands of unique keys creates that many permanent atoms and a handful of such requests exhausts the table and aborts the node. The impact is confined to availability: no data is read or altered, and recovery requires restarting the application.
This issue affects absinthe_federation: from 0.1.0 before 0.9.3.
Weakness: CWE-770
Which versions are affected by CVE-2026-67585?
1 open source package ship an affected version, including absinthe_federation.
| Package | Affected | Fixed in |
|---|---|---|
absinthe_federation Hex | From 0.1.0 | 0.9.3 |
How do I fix CVE-2026-67585?
Upgrade absinthe_federation to 0.9.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-67585 being exploited?
There is no known exploitation of CVE-2026-67585 in the wild and no public exploit code.
Sources
Also known as EEF-CVE-2026-67585, GHSA-55hv-mwvr-phf3, GHSA-cvf2-gh5f-v69p.