CVE-2026-67585: absinthe_federation 0.1.0 to before 0.9.3

Affected technology

absinthe_federation · 0.1.0 to before 0.9.3
DivvyPayHQ

absinthe_federation · 640a234a26b2d6fe5d9d21e00e5f4fce5645c0bf to before c3838cda2a7f65c4893291668c223b0d6acf4516
DivvyPayHQ

Component: 'Elixir.Absinthe.Federation.Schema.EntitiesField'
Function: 'Elixir.Absinthe.Federation.Schema.EntitiesField':resolver/3, 'Elixir.Absinthe.Federation.Schema.EntitiesField':convert_keys_to_atom/2, 'Elixir.Absinthe.Federation.Schema.EntitiesField':convert_key/2
File: lib/absinthe/federation/schema/entities_field.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker can abort the Erlang VM via crafted _entities representation keys. Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as none; availability impact as high.