absinthe-graphql
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| absinthe | 2 | – | May 8, 2026 |
| absinthe_plug | 1 | – | May 8, 2026 |
Exploited and recent CVEs
- CVE-2026-42793 Atom table exhaustion via attacker-controlled GraphQL SDL names in absinthe 0.6%
- CVE-2026-42794 Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plug 0.3%
- CVE-2026-43967 Quadratic fragment-name uniqueness check causes denial of service in absinthe 0.6%