{"answers":{"affected":"1 open source package ship an affected version, including absinthe_federation.","exploited":"There is no known exploitation of CVE-2026-67585 in the wild and no public exploit code.","fix":"Upgrade absinthe_federation to 0.9.3 or later.","what":"CVE-2026-67585 is a high-severity denial of service vulnerability in DivvyPayHQ absinthe_federation, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-67585 and fix it if it is affected.\n\nWhat it is: CVE-2026-67585 is a high-severity denial of service vulnerability in DivvyPayHQ absinthe_federation, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-67585 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- absinthe_federation (Hex): affected from 0.1.0; fixed in 0.9.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-67585/ (Markdown: https://insights.sbomify.com/CVE-2026-67585/index.md)","id":"CVE-2026-67585","markdown":"https://insights.sbomify.com/CVE-2026-67585/index.md","name":"CVE-2026-67585","record":{"aliases":["EEF-CVE-2026-67585","GHSA-55hv-mwvr-phf3","GHSA-cvf2-gh5f-v69p"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Elixir GraphQL library","requires_auth":"none","summary":"Unauthenticated attackers can crash the Erlang VM by exhausting the atom table via crafted GraphQL federation keys in absinthe_federation.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"EEF","cpe":[],"cvss":{"score":8.7,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"}],"description":"Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthe_federation allows an unauthenticated remote attacker to abort the Erlang VM via crafted _entities representation keys.\n\nEvery key of every object in the representations argument of the federation-mandated _entities field is converted with String.to_atom/1 by convert_key/2 in lib/absinthe/federation/schema/entities_field.ex. representations is typed as the open-ended _Any scalar, so its keys bypass schema coercion and the attacker names them freely. Atoms are never garbage collected and the BEAM atom table is hard-capped (about 1,048,576 entries by default), so one request carrying tens of thousands of unique keys creates that many permanent atoms and a handful of such requests exhausts the table and aborts the node. The impact is confined to availability: no data is read or altered, and recovery requires restarting the application.\n\nThis issue affects absinthe_federation: from 0.1.0 before 0.9.3.","ecosystems":["Hex"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation","id":"CVE-2026-67585","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Hex","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":1,"n_references":4,"next":{"headline":"Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget","id":"CVE-2026-67587"},"packages":[{"ecosystem":"Hex","fixed":["0.9.3"],"introduced":["0.1.0"],"last_affected":[],"package":"absinthe_federation","purl":"pkg:hex/absinthe_federation","source":"EEF-CVE-2026-67585"}],"prev":{"headline":"On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay","id":"CVE-2026-67581"},"products":["absinthe_federation"],"published":"2026-08-07","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Erlang Ecosystem Foundation","prefix":"EEF"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-07","vendors":["DivvyPayHQ"]},"summary":"Unauthenticated attackers can crash the Erlang VM by exhausting the atom table via crafted GraphQL federation keys in absinthe_federation.","url":"https://insights.sbomify.com/CVE-2026-67585/"}