CVE-2026-42793

Allocation of Resources Without Limits or Throttling vulnerability in absinthe-graphql absinthe allows unauthenticated denial of service via atom table exhaustion when parsing attacker-controlled GraphQL SDL. Multiple Blueprint.Draft.convert/2 implementations in Absinthe's SDL language modules call String.to_atom/1 on attacker-controlled names from parsed GraphQL SDL documents, including directive names, field names, type names, and argument names. Because atoms are never garbage-collected and the BEAM atom table has a fixed limit (default 1,048,576), each unique name permanently consumes one slot. An attacker can exhaust the atom table by submitting SDL documents containing enough unique names, causing the Erlang VM to abort with system_limit and taking down the entire node. Any application that passes attacker-controlled GraphQL SDL through Absinthe's parser is exposed — for example, a schema-upload endpoint, a federation gateway that ingests remote SDL, or any developer tool that runs the parser over user-supplied documents. This issue affects absinthe: from 1.5.0 before 1.10.2.

• CWE-770

• https://cna.erlef.org/cves/CVE-2026-42793.htmlThird Party Advisory
• https://github.com/absinthe-graphql/absinthe/commit/dd842b938e3823f345c10416914ffab5d5536838Patch
• https://github.com/absinthe-graphql/absinthe/security/advisories/GHSA-qf4g-9fqq-mmm7Exploit, Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-42793Third Party Advisory

Published

May 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42788Allocation of Resources Without Limits or Throttling vulnera…6.9
• CVE-2026-42789Improper Following of a Certificate's Chain of Trust vulnera…4.8
• CVE-2026-4279The Bread & Butter plugin for WordPress is vulnerable to Sto…6.4
• CVE-2026-42790Improper Certificate Validation vulnerability in Erlang OTP …8.1
• CVE-2026-42791Improper Certificate Validation vulnerability in Erlang OTP …3.7
• CVE-2026-42792Improper Handling of Exceptional Conditions vulnerability in…7.5
• CVE-2026-42794Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2026-42795Symlink following vulnerability in Gleam's Hex package expor…5.1
• CVE-2026-42796Arelle before 2.39.10 contains an unauthenticated remote cod…9.8
• CVE-2026-42797Exposure of Sensitive Information Through Data Queries vulne…4.9
• CVE-2026-42798Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an inte…4
• CVE-2026-42799Out-of-bounds read vulnerability in ASR Kestrel (nr_fw modul…9.8