The vulnerability is an implementation of inefficient algorithmic complexity in the fragment-name uniqueness validation logic of the Absinthe GraphQL framework. The validator performs a full O(N²) comparison for each document, where N is the number of fragment definitions supplied by the attacker. By submitting a query with a large number of fragments, an adversary can trigger billions of comparisons, consuming CPU time and memory and effectively blocking the Absinthe process. No authentication, special configuration, or schema knowledge is required, making the condition fully controllable by an unauthenticated user. As the validation occurs early in the request pipeline, the impact manifests as a denial of service that can affect service availability for any client that interacts with the GraphQL endpoint.

The affected product is the Absinthe GraphQL framework, version 1.2.0 through 1.10.1. Any instance of the framework in those releases is susceptible, regardless of deployment environment. The product is maintained by the absinthe‑graphql community and available through standard Elixir package distribution channels.

The CVSS score of 8.7 indicates high severity with potential for large impact on availability. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the vulnerability requires no privileged input, so the likelihood of exploitation in the wild could be high. The issue is not listed in the CISA KEV catalog, yet the lack of authentication means systems exposed to the Internet could be targeted easily. Attacking via a crafted GraphQL query is the most probable vector, making the risk significant for exposed services.