Absinthe's GraphQL SDL parser unconstrainedly converts names from an incoming SDL document into Erlang atoms. Because atoms are immutable and never garbage collected, each unique name permanently occupies a slot in a fixed‑size table (default 1,048,576). An attacker who can supply many distinct SDL names – for instance by uploading a malicious schema or crafting federation requests – can exhaust the table, causing the Erlang VM to raise a system_limit exception and terminate the node. The resulting loss of service is complete and occurs without authentication. This flaw is identified by CWE-770.

Any host using the Absinthe GraphQL library from version 1.5.0 through 1.10.1 (i.e., any release earlier than 1.10.2) is vulnerable. Applications that expose schema‑upload endpoints, federation gateways that ingest remote SDL, or development tools that parse user content can all trigger the flaw.

The CVSS score of 8.2 signals high severity. No EPSS data is included, so the current exploitation probability is undetermined; the vulnerability is not yet listed in the CISA KEV catalog. The attack vector is likely remote: an unauthenticated adversary can deliver the harmful SDL to any exposed endpoint that feeds the parser. Once the atom table limit is hit, the Erlang VM aborts and the entire node shuts down, delivering a denial of service.