8.7
/ 10
HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Description
Inefficient Algorithmic Complexity vulnerability in absinthe-graphql absinthe allows unauthenticated denial of service via quadratic fragment-name uniqueness validation.
'Elixir.Absinthe.Phase.Document.Validation.UniqueFragmentNames':run/2 iterates over all fragments and for each one calls duplicate?/2, which evaluates Enum.count(fragments, &(&1.name == name)) ā a full linear scan of the fragment list. The result is O(NĀ²) comparisons per document, where N is the number of fragment definitions supplied by the caller.
Because input.fragments is built directly from the GraphQL query body, N is fully attacker-controlled. A minimum-size fragment definition is roughly 16 bytes, so a ~1 MB document carries ~60,000 fragments and forces ~3.6 Ć 10ā¹ comparisons inside this single validation phase. No authentication, schema knowledge, or special configuration is required.
This issue affects absinthe: from 1.2.0 before 1.10.2.
'Elixir.Absinthe.Phase.Document.Validation.UniqueFragmentNames':run/2 iterates over all fragments and for each one calls duplicate?/2, which evaluates Enum.count(fragments, &(&1.name == name)) ā a full linear scan of the fragment list. The result is O(NĀ²) comparisons per document, where N is the number of fragment definitions supplied by the caller.
Because input.fragments is built directly from the GraphQL query body, N is fully attacker-controlled. A minimum-size fragment definition is roughly 16 bytes, so a ~1 MB document carries ~60,000 fragments and forces ~3.6 Ć 10ā¹ comparisons inside this single validation phase. No authentication, schema knowledge, or special configuration is required.
This issue affects absinthe: from 1.2.0 before 1.10.2.
AI Analysis
Denial of Service via quadratic fragment-name uniqueness validation
Basic Information
ID
CVE-2026-43967
Source
EEF
Published
May 8, 2026 at 15:42
Modified
May 8, 2026 at 16:07
Affected Product
Vendor
absinthe-graphql
Product
absinthe
Version
1.2.0
Affected Versions
absinthe-graphql absinthe 1.2.0
absinthe-graphql absinthe 0b46e3bcc06c0d3797bacd64761b908a84646c1d
absinthe-graphql absinthe 0b46e3bcc06c0d3797bacd64761b908a84646c1d
CWE Classification
AI Assessment
AI Score
8.7 / 10
AI Severity
High
Vendor
absinthe-graphql
Product
absinthe
Version
1.2.0-1.10.2