The vulnerability arises because the absinthe_federation library converts every key in the _entities representations argument into atoms using String.to_atom/1 without limits or throttling. Since atoms in the Erlang VM are not garbage collected and the atom table has a fixed maximum size (about 1,048,576 entries), an attacker can send a request with tens of thousands of unique keys to exhaust the atom table, causing the Erlang VM to abort. This results in a denial of service condition. The vulnerability affects absinthe_federation versions from 0.1.0 before 0.9.3.

An unauthenticated remote attacker can cause a denial of service by exhausting the Erlang VM atom table, leading to the node aborting. There is no impact on data confidentiality or integrity. Recovery requires restarting the affected application instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing request size limits or filtering to prevent excessive unique keys in _entities representations. Monitor for unusual request patterns that could indicate exploitation attempts.