PT-2026-39148 · Absinthe · Absinthe
Curtis Schiewek
+1
·
Published
2026-05-08
·
Updated
2026-05-14
·
CVE-2026-43967
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
absinthe versions 1.2.0 through 1.10.1
Description
An inefficient algorithmic complexity issue allows unauthenticated denial of service through quadratic fragment-name uniqueness validation. The function
run/2 within Elixir.Absinthe.Phase.Document.Validation.UniqueFragmentNames iterates over all fragments and calls duplicate?/2, which performs a full linear scan of the fragment list using Enum.count(fragments, &(&1.name == name)). This results in O(N²) comparisons per document, where N is the number of fragment definitions provided by the caller. Since input.fragments is constructed directly from the GraphQL query body, an attacker can control N. For example, a document of approximately 1 MB containing about 60,000 fragments can force approximately 3.6 × 10⁹ comparisons during this validation phase without requiring authentication, schema knowledge, or special configuration.Recommendations
Update to version 1.10.2 or later.
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Absinthe