Loading story…
A high-severity denial-of-service vulnerability tracked as CVE-2026-43967 affects the Elixir GraphQL library Absinthe, where fragment-name uniqueness checks in Elixir.Absinthe.Phase.Document.Validation.UniqueFragmentNames.run/2 use a quadratic-time algorithm. The flaw impacts absinthe versions 1.2.0 before 1.10.2 and allows a remote, unauthenticated attacker to submit a specially crafted GraphQL document that forces excessive processing during validation.
Reports say a single HTTP request containing a large number of minimal fragment definitions can consume disproportionate CPU resources, degrading application availability and potentially starving Erlang VM schedulers. Researchers noted that a query of roughly 1 MB with about 60,000 fragments can trigger approximately 3.6 billion comparisons in one validation phase, making the issue a classic algorithmic complexity denial of service classified as CWE-407.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A denial-of-service vulnerability in the absinthe-graphql Absinthe library was disclosed as CVE-2026-43967. The flaw affects versions 1.2.0 before 1.10.2 and stems from quadratic-time fragment-name uniqueness validation that allows unauthenticated attackers to trigger excessive CPU consumption with a large GraphQL query.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity flaw tracked as **`CVE-2026-5423`** was disclosed in the **`@neo4j/graphql`** library, allowing unauthenticated remote attackers to bypass subscription authentication over GraphQL WebSocket connections. The issue stems from the library accepting a pre-decoded JWT object supplied in `connectionParams.jwt` without verification, causing forged claims to be treated as an authenticated identity during subscription setup. Successful exploitation can let attackers evade controls enforced by `@authentication` and `@subscriptionsAuthorization` directives and receive subscription events intended only for specific users or roles, creating risks of information disclosure, spoofing, and security restriction bypass. Affected releases include **7.0.0 through before 7.5.6**, **5.0.0 through before 5.12.14**, and **all 6.x versions through 6.6.4**; Neo4j has advised customers to upgrade to **7.5.6+** or **5.12.14+**, while the **6.x** branch is end-of-life and will not receive a fix.
Aug 7, 2026
Erlang/OTP users were urged to patch after multiple vulnerabilities were disclosed across the platform, including high-severity flaws that can crash BEAM nodes or exhaust resources during normal protocol handling. **CVE-2026-59251** affects `public_key` certificate path validation, where a crafted X.509 chain can trigger exponential certificate policy tree growth during a TLS handshake and consume CPU and memory until the VM fails. **CVE-2026-58227** affects the `ssl` application, where mutually cross-signed certificates can cause unbounded recursion while rebuilding incomplete TLS or DTLS peer chains, allowing an unauthenticated attacker to crash either servers or clients before authentication completes. A separate high-severity flaw, **CVE-2026-54890**, impacts the `erts` External Term Format decoder used by `binary_to_term/1`, `binary_to_term/2`, and `enif_binary_to_term()`, where an integer underflow in `BIT_BINARY_EXT` decoding can trigger near-`2^64` memory allocation and terminate the entire Erlang VM. National cyber authorities in Canada and Italy published advisories directing administrators to review Erlang security bulletins and update affected releases, while the Italian notice said the broader disclosure set includes additional Erlang/OTP issues spanning denial of service, remote code execution, authentication bypass, and security feature bypass. Fixed versions cited across the disclosures include **27.3.4.15**, **28.5.0.4**, and **29.0.4**.
Jul 29, 2026
A high-severity denial-of-service vulnerability in the Node.js library **Shescape** allows a remote unauthenticated attacker to exhaust CPU resources and halt application processing by sending crafted input to the library's `compose()` function. The flaw, tracked as **`GHSA-gm3r-q2wp-hw87`**, is caused by quadratic-time behavior in the library's default flag-protection logic, where repeated array copying and string joining inside a loop can be abused with repeated null-byte and hyphen sequences to block the single-threaded Node.js event loop. The issue is classified under **`CWE-407`** and **`CWE-400`** and carries a **CVSS v4.0 score of 8.7**. The bug fits the broader **Endpoint Denial of Service** technique documented by MITRE ATT&CK as **`T1499`**, in which attackers degrade or prevent service availability by exhausting host or application resources rather than saturating network bandwidth. In this case, the attack targets the application stack directly, causing total service disruption through algorithmic complexity and CPU exhaustion. Maintainers fixed the issue by replacing the repeated copy-and-join loop with an index-based linear scan, and users are advised to upgrade to **Shescape 2.1.14** or **3.0.1**.
Jul 25, 2026