The vulnerability arises because every key in the representations argument of the federation-mandated _entities field is converted to an Erlang atom using String.to_atom/1 without limits or throttling. Since atoms are not garbage collected and the BEAM atom table has a fixed size (about 1,048,576 entries), an attacker can send a request with tens of thousands of unique keys, exhausting the atom table and causing the Erlang VM to abort. This denial-of-service condition affects availability only and requires application restart for recovery. The affected software is absinthe_federation versions >=0.1.0 and <0.9.3.

The impact is a denial-of-service condition where the Erlang VM aborts due to exhaustion of the atom table. No data confidentiality or integrity is compromised. The service becomes unavailable until it is manually restarted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing request size limits or input validation to restrict the number of unique keys in the _entities representations argument to prevent atom table exhaustion.