Executive brief
Absinthe, a popular GraphQL toolkit for the Elixir programming language, is vulnerable to a denial-of-service attack. An unauthenticated attacker can send a specially crafted request containing many 'fragments' that forces the server to perform excessive calculations, potentially freezing the application and making it unavailable to legitimate users. This issue can be exploited without any special access or knowledge of the system's internal data structures.
Technical details
The vulnerability exists in the 'UniqueFragmentNames' validation phase of the Absinthe GraphQL pipeline. The 'run/2' function in 'Elixir.Absinthe.Phase.Document.Validation.UniqueFragmentNames' performs a quadratic O(N²) comparison by iterating over all fragments and performing a linear scan for each to ensure name uniqueness. Because the number of fragments (N) is controlled by the attacker via the GraphQL query body and is not sufficiently capped, a relatively small request (e.g., 1 MB) can trigger billions of comparisons. This results in CPU exhaustion and worker pool starvation. The issue is fixed in version 1.10.2 by implementing a linear O(N) validation approach using a MapSet.
Affected products
- absinthe-graphql absinthe >= 1.2.0, < 1.10.2
Timeline
- 2026-05-08: disclosed
- 2026-05-08: advisory
- 2026-05-08: patched: Fixed in version 1.10.2