The vulnerability in absinthe-graphql absinthe involves multiple implementations of Blueprint.Draft.convert/2 calling String.to_atom/1 on untrusted GraphQL SDL names (directive, field, type, argument names). Since atoms in the Erlang VM are not garbage collected and the atom table has a fixed size, an attacker can submit SDL documents with many unique names to exhaust the atom table. This causes the Erlang VM to abort with a system_limit error, resulting in denial of service by crashing the entire node. This affects absinthe versions from 1.5.0 up to but not including 1.10.2. The CVSS 4.0 score is 8.2 (high severity), reflecting network attack vector, no privileges required, no user interaction, and high impact on availability.

Successful exploitation results in denial of service by crashing the Erlang VM node running Absinthe due to atom table exhaustion. This disrupts availability of applications parsing attacker-controlled GraphQL SDL input. There is no indication of confidentiality or integrity impact. The vulnerability affects any application that processes untrusted SDL documents through Absinthe's parser.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid parsing untrusted or attacker-controlled GraphQL SDL documents with vulnerable versions of Absinthe. Implement input validation or throttling on SDL inputs if possible to limit unique atom creation. Monitor vendor channels for updates and apply official patches once available.