absinthe-graphql

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

absinthe-graphql records in CISA KEV

No absinthe-graphql vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Absinthe 2 records MEDIUM Absinthe.plug 1 record MEDIUM

Records

3 records

TI-2026-32012 CVE-2026-43967 · GHSA-9mhv-8h52-q7q2

Quadratic fragment-name uniqueness check causes denial of service in absinthe

MEDIUM 45

Inefficient Algorithmic Complexity vulnerability in absinthe-graphql absinthe allows unauthenticated denial of service via quadratic fragment-name uniqueness validation.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00624 Published 2026-05-08 Fixed in 1.10.2 CWE-407

TI-2026-31014 CVE-2026-42794 · GHSA-c62g-j346-39v5

Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plug

MEDIUM 45

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in absinthe-graphql absinthe_plug allows reflected cross-site scripting via the GraphiQL interface.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00282 Published 2026-05-08 Fixed in 1.5.10 CWE-79

TI-2026-31013 CVE-2026-42793 · GHSA-qf4g-9fqq-mmm7

Atom table exhaustion via attacker-controlled GraphQL SDL names in absinthe

LOW 37

Allocation of Resources Without Limits or Throttling vulnerability in absinthe-graphql absinthe allows unauthenticated denial of service via atom table exhaustion when parsing attacker-controlled GraphQL SDL.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00613 Published 2026-05-08 Fixed in 1.10.2 CWE-770

Open these records in search →

Critical	0
High	2
Medium	0
Low	1
No CVSS	0