Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

absinthe-graphql/absinthe

              main @ 33db991
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Insecure Context Handling: 2 prior fixes. Scrutinize any change in this area.

lib/absinthe/subscription/local.ex: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure Context Handling: Subscribers sharing batch resolution phases could experience cross-context data leaks if their underlying subscription documents are not strictly grouped and isolated by their execution contexts prior to publishing.

Resource Exhaustion: Quadratic validation complexity in validation phases allows unauthenticated attackers to trigger denial of service via CPU exhaustion using deeply nested or highly repetitive fragment names.

Resource Exhaustion: Unchecked conversion of attacker-controlled GraphQL SDL names into Erlang/Elixir atoms can lead to VM-wide denial of service via atom table exhaustion.