GHSA-9pv7-vfvm-6vr7
- Gravità
- Moderata
- CVSS
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CISA KEV
- Non presente nel catalogo KEV in cache
- EPSS
- Nessun punteggio EPSS in cache
Versioni interessate e corrette
- Introdotta in 16.3.0 · corretta in 16.8.1
L'ultima versione pubblicata non è in un intervallo interessato, oppure OSV non indica correzioni.
Il testo semplificato appare solo se già in cache. Questa pagina non lo genera.
graphql Uncontrolled Resource Consumption vulnerability
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not proven that this vulnerability can crash the process.
Alias: CVE-2023-26144
Avviso su OSV.dev · pubblicato il 2023-09-20 · modificato il 2023-11-08
- https://nvd.nist.gov/vuln/detail/CVE-2023-26144
- https://github.com/graphql/graphql-js/issues/3955
- https://github.com/graphql/graphql-js/pull/3972
- https://github.com/graphql/graphql-js/commit/8f4c64eb6a7112a929ffeef00caa67529b3f2fcf
- https://github.com/graphql/graphql-js
- https://github.com/graphql/graphql-js/releases/tag/v16.8.1