Hex Package Vulnerabilities
Vulnerabilities associated with absinthe.
Packages
Clear package- hackney12 vulnerabilities
- bandit7 vulnerabilities
- tesla5 vulnerabilities
- ash4 vulnerabilities
- cowlib4 vulnerabilities
- gun4 vulnerabilities
- mint4 vulnerabilities
- plug4 vulnerabilities
- rabbit_common4 vulnerabilities
- ewe3 vulnerabilities
- phoenix3 vulnerabilities
- phoenix_storybook3 vulnerabilities
- absinthe2 vulnerabilities
- ash_authentication2 vulnerabilities
- cowboy2 vulnerabilities
- hex_core2 vulnerabilities
- oban_web2 vulnerabilities
- phoenix_html2 vulnerabilities
- pow2 vulnerabilities
- req2 vulnerabilities
- wisp2 vulnerabilities
- MongooseIM1 vulnerability
- RabbitMQ1 vulnerability
- Samly1 vulnerability
- absinthe_plug1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-42793HIGH | Atom table exhaustion via attacker-controlled GraphQL SDL names in absintheAllocation of Resources Without Limits or Throttling vulnerability in absinthe-graphql absinthe allows unauthenticated denial of service via atom table exhaustion when parsing attacker-controlled GraphQL SDL. Multiple Blueprint.Draft.convert/2 implementations in Absinthe's SDL language modules call String.to_atom/1 on attacker-controlled names from parsed GraphQL SDL documents, including directive names, field names, type names, and argument names. Because atoms are never garbage-collected and … CWE-770May 8, 2026 | CVSS8.2v4.0 | EPSS0.613% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-43967HIGH | Quadratic fragment-name uniqueness check causes denial of service in absintheInefficient Algorithmic Complexity vulnerability in absinthe-graphql absinthe allows unauthenticated denial of service via quadratic fragment-name uniqueness validation. 'Elixir.Absinthe.Phase.Document.Validation.UniqueFragmentNames':run/2 iterates over all fragments and for each one calls duplicate?/2, which evaluates Enum.count(fragments, &(&1.name == name)) — a full linear scan of the fragment list. The result is O(N²) comparisons per document, where N is the number of fragment definitions s… CWE-407May 8, 2026 | CVSS8.7v4.0 | EPSS0.624% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |