An unauthenticated resource exhaustion vulnerability in DivvyPayHQ absinthe_federation allows remote attackers to crash the host Erlang VM.

The application fails to limit resource allocation when processing specifically crafted _entities representation keys, leading to a denial of service (CWE-770) that forces the Erlang VM to abort.

The vulnerability allows an unauthenticated attacker to cause a complete denial of service for any application utilizing the affected library. With a CVSS score of 8.7, the ability to remotely crash the underlying Erlang VM poses a critical threat to service availability and business continuity. This could result in significant downtime for services relying on the federated API.

Immediate Action: Update the absinthe_federation library to version 0.9.3 or higher to apply the necessary resource limits and input validation.

Proactive Monitoring: Monitor server logs and Erlang VM health metrics for sudden crashes or anomalous resource spikes associated with incoming API requests.

Compensating Controls: Deploy a Web Application Firewall or load balancer to inspect and filter incoming requests, specifically looking for malformed or excessively large _entities payloads.

Public Exploit Available: Unknown.

Given that this vulnerability can be triggered by an unauthenticated attacker to cause a total service failure, it should be treated with extreme urgency. Developers must update the library immediately to ensure the Erlang VM remains resilient against malicious input.