CVE-2026-42793

🗓️ 08 May 2026 15:42:46Reported by EEFType

cve🔗 web.nvd.nist.gov👁 47 Views🌐 WEB

Absinthe exposes unauthenticated denial of service via atom table exhaustion from supplied names.

Reporter	Title	Published	Views	Family All 15
attackerkb	CVE-2026-42793	8 May 202615:42	–	attackerkb
Circl	CVE-2026-42793	8 May 202616:15	–	circl
CNNVD	Absinthe security vulnerability	8 May 202600:00	–	cnnvd
Cvelist	CVE-2026-42793 Atom table exhaustion via attacker-controlled GraphQL SDL names in absinthe	8 May 202615:42	–	cvelist
EUVD	EUVD-2026-28798	14 May 202613:08	–	euvd
Github Security Blog	Absinthe: Unbounded atom creation from parsed directive name	14 May 202613:08	–	github
Mend	CVE-2026-42793	8 May 202615:42	–	mend
NVD	CVE-2026-42793	8 May 202616:16	–	nvd
osv_cve	CVE-2026-42793 Atom table exhaustion via attacker-controlled GraphQL SDL names in absinthe	8 May 202615:42	–	osv_cve
osv_eef	EEF-CVE-2026-42793 Atom table exhaustion via attacker-controlled GraphQL SDL names in absinthe	8 May 202615:42	–	osv_eef

NVD

Vulners

CNA

Node

absinthe-graphql absintheRange1.5.0–1.10.2

[
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:absinthe-graphql:absinthe:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.Absinthe.Language.DirectiveDefinition'",
      "'Elixir.Absinthe.Language.EnumTypeDefinition'",
      "'Elixir.Absinthe.Language.FieldDefinition'",
      "'Elixir.Absinthe.Language.InputObjectTypeDefinition'",
      "'Elixir.Absinthe.Language.InputValueDefinition'",
      "'Elixir.Absinthe.Language.InterfaceTypeDefinition'",
      "'Elixir.Absinthe.Language.ObjectTypeDefinition'",
      "'Elixir.Absinthe.Language.ScalarTypeDefinition'",
      "'Elixir.Absinthe.Language.UnionTypeDefinition'"
    ],
    "packageName": "absinthe",
    "packageURL": "pkg:hex/absinthe",
    "product": "absinthe",
    "programFiles": [
      "lib/absinthe/language/directive_definition.ex",
      "lib/absinthe/language/enum_type_definition.ex",
      "lib/absinthe/language/field_definition.ex",
      "lib/absinthe/language/input_object_type_definition.ex",
      "lib/absinthe/language/input_value_definition.ex",
      "lib/absinthe/language/interface_type_definition.ex",
      "lib/absinthe/language/object_type_definition.ex",
      "lib/absinthe/language/scalar_type_definition.ex",
      "lib/absinthe/language/union_type_definition.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.DirectiveDefinition':convert/2"
      },
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.EnumTypeDefinition':convert/2"
      },
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.FieldDefinition':convert/2"
      },
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.InputObjectTypeDefinition':convert/2"
      },
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.InputValueDefinition':convert/2"
      },
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.InterfaceTypeDefinition':convert/2"
      },
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.ObjectTypeDefinition':convert/2"
      },
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.ScalarTypeDefinition':convert/2"
      },
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.UnionTypeDefinition':convert/2"
      }
    ],
    "repo": "https://github.com/absinthe-graphql/absinthe",
    "vendor": "absinthe-graphql",
    "versions": [
      {
        "lessThan": "1.10.2",
        "status": "affected",
        "version": "1.5.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:absinthe-graphql:absinthe:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.Absinthe.Language.DirectiveDefinition'",
      "'Elixir.Absinthe.Language.EnumTypeDefinition'",
      "'Elixir.Absinthe.Language.FieldDefinition'",
      "'Elixir.Absinthe.Language.InputObjectTypeDefinition'",
      "'Elixir.Absinthe.Language.InputValueDefinition'",
      "'Elixir.Absinthe.Language.InterfaceTypeDefinition'",
      "'Elixir.Absinthe.Language.ObjectTypeDefinition'",
      "'Elixir.Absinthe.Language.ScalarTypeDefinition'",
      "'Elixir.Absinthe.Language.UnionTypeDefinition'"
    ],
    "packageName": "absinthe-graphql/absinthe",
    "packageURL": "pkg:github/absinthe-graphql/absinthe",
    "product": "absinthe",
    "programFiles": [
      "lib/absinthe/language/directive_definition.ex",
      "lib/absinthe/language/enum_type_definition.ex",
      "lib/absinthe/language/field_definition.ex",
      "lib/absinthe/language/input_object_type_definition.ex",
      "lib/absinthe/language/input_value_definition.ex",
      "lib/absinthe/language/interface_type_definition.ex",
      "lib/absinthe/language/object_type_definition.ex",
      "lib/absinthe/language/scalar_type_definition.ex",
      "lib/absinthe/language/union_type_definition.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.DirectiveDefinition':convert/2"
      },
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.EnumTypeDefinition':convert/2"
      },
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.FieldDefinition':convert/2"
      },
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.InputObjectTypeDefinition':convert/2"
      },
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.InputValueDefinition':convert/2"
      },
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.InterfaceTypeDefinition':convert/2"
      },
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.ObjectTypeDefinition':convert/2"
      },
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.ScalarTypeDefinition':convert/2"
      },
      {
        "name": "'Elixir.Absinthe.Blueprint.Draft.Absinthe.Language.UnionTypeDefinition':convert/2"
      }
    ],
    "repo": "https://github.com/absinthe-graphql/absinthe",
    "vendor": "absinthe-graphql",
    "versions": [
      {
        "lessThan": "dd842b938e3823f345c10416914ffab5d5536838",
        "status": "affected",
        "version": "d0eae7764520d4e8e5dfff619068c0de911aec33",
        "versionType": "git"
      }
    ]
  }
]

Source	Link
cna	www.cna.erlef.org/cves/CVE-2026-42793.html
github	www.github.com/absinthe-graphql/absinthe/security/advisories/GHSA-qf4g-9fqq-mmm7
osv	www.osv.dev/vulnerability/EEF-CVE-2026-42793
github	www.github.com/absinthe-graphql/absinthe/commit/dd842b938e3823f345c10416914ffab5d5536838

Parameter	Position	Path	Description	CWE
GraphQL SDL	request body	/schema-upload	Unauthenticated denial of service via atom table exhaustion when parsing attacker-controlled GraphQL SDL documents on a schema-upload endpoint.	CWE-770
remote SDL	request body	/federation gateway	Denial of service via atom table exhaustion when a federation gateway ingests remote SDL documents.	CWE-770

17 Jun 2026 10:48Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

CVSS 48.2

EPSS0.00613

SSVC

CWE-770