# CVE-2026-67585: Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation

> Unauthenticated attackers can crash the Erlang VM by exhausting the atom table via crafted GraphQL federation keys in absinthe_federation.

- **Severity:** High 8.7 (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 7 Aug 2026
- **Updated:** 7 Aug 2026
- **Also known as:** EEF-CVE-2026-67585, GHSA-55hv-mwvr-phf3, GHSA-cvf2-gh5f-v69p

## What is CVE-2026-67585?

CVE-2026-67585 is a high-severity denial of service vulnerability in DivvyPayHQ absinthe_federation, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthe_federation allows an unauthenticated remote attacker to abort the Erlang VM via crafted _entities representation keys.

Every key of every object in the representations argument of the federation-mandated _entities field is converted with String.to_atom/1 by convert_key/2 in lib/absinthe/federation/schema/entities_field.ex. representations is typed as the open-ended _Any scalar, so its keys bypass schema coercion and the attacker names them freely. Atoms are never garbage collected and the BEAM atom table is hard-capped (about 1,048,576 entries by default), so one request carrying tens of thousands of unique keys creates that many permanent atoms and a handful of such requests exhausts the table and aborts the node. The impact is confined to availability: no data is read or altered, and recovery requires restarting the application.

This issue affects absinthe_federation: from 0.1.0 before 0.9.3.

Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling)

## Which versions are affected by CVE-2026-67585?

1 open source package ship an affected version, including absinthe_federation.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `absinthe_federation` | Hex | From 0.1.0 | 0.9.3 |

## How do I fix CVE-2026-67585?

Upgrade absinthe_federation to 0.9.3 or later.

## Is CVE-2026-67585 being exploited?

There is no known exploitation of CVE-2026-67585 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-67585 and fix it if it is affected.

What it is: CVE-2026-67585 is a high-severity denial of service vulnerability in DivvyPayHQ absinthe_federation, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-67585 in the wild and no public exploit code.

Affected packages and fixed versions:
- absinthe_federation (Hex): affected from 0.1.0; fixed in 0.9.3

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-67585/ (Markdown: https://insights.sbomify.com/CVE-2026-67585/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-67585
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-67585
- OSV: https://osv.dev/vulnerability/CVE-2026-67585

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-67585/
Summaries are generated and may contain mistakes; the official description above is the record.