Read the docs
TI-2026-32012 Aliases CVE-2026-43967GHSA-9mhv-8h52-q7q2

Quadratic fragment-name uniqueness check causes denial of service in absinthe

Priority MEDIUM 45CWE-407Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-407.

Summary

Inefficient Algorithmic Complexity vulnerability in absinthe-graphql absinthe allows unauthenticated denial of service via quadratic fragment-name uniqueness validation. 'Elixir.Absinthe.Phase.Document.Validation.UniqueFragmentNames':run/2 iterates over all fragments and for each one calls duplicate?/2, which evaluates Enum.count(fragments, &(&1.name == name)) — a full linear scan of the fragment list. The result is O(N²) comparisons per document, where N is the number of fragment definitions supplied by the caller. Because input.fragments is built directly from the GraphQL query body, N is fully attacker-controlled. A minimum-size fragment definition is roughly 16 bytes, so a ~1 MB document carries ~60,000 fragments and forces ~3.6 × 10⁹ comparisons inside this single validation phase. No authentication, schema knowledge, or special configuration is required. This issue affects absinthe: from 1.2.0 before 1.10.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00624 50th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed absinthe (absinthe-graphql): 1.10.2absinthe (Hex): 1.10.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
absinthe-graphqlabsinthe1.2.0 to before 1.10.21.10.2Patch availableCNA
—absinthe (Hex)1.2.0 to before 1.10.21.10.2Patch availableGHSA-9mhv-8h52-q7q2
  • absinthe Vendorabsinthe-graphql Affected 1.2.0 to before 1.10.2 Fixed in 1.10.2 Patch available CNA
  • absinthe (Hex) Vendor— Affected 1.2.0 to before 1.10.2 Fixed in 1.10.2 Patch available GHSA-9mhv-8h52-q7q2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:absinthe-graphql:absinthe:*:*:*:*:*:*:*:*after 1.2.0, before 1.10.2Vulnerableabsinthe-graphql
  • cpe:2.3:a:absinthe-graphql:absinthe:*:*:*:*:*:*:*:* Versions after 1.2.0, before 1.10.2 Vulnerable ·absinthe-graphql

Remediation

  • Fix · CNA absinthe (absinthe-graphql) Fixed in 1.10.2
  • Fix · GHSA-9mhv-8h52-q7q2 absinthe (Hex) Fixed in 1.10.2 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    absinthe-graphql absinthe 1.10.2

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-31013 Atom table exhaustion via attacker-controlled GraphQL SDL names in absinthePriority LOW 37
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43967
  2. 2026-10-03 Alias added: GHSA-9mhv-8h52-q7q2
  3. 2026-10-25 EPSS moved to the below the 50th percentile
  4. 2026-11-04 EPSS moved to the 50th–90th percentile

References

Exploit 1

Patch 2

Advisory 2

Other 1

  • TI-2026-31013 Atom table exhaustion via attacker-controlled GraphQL SDL names in absinthe CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences