Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance.
**Note:** It was not proven that this vulnerability can crash the process.
References
| Link | Resource |
|---|---|
| https://github.com/graphql/graphql-js/commit/f94b511386c7e47bd0380dcd56553dc063320226 | Patch |
| https://github.com/graphql/graphql-js/issues/3955 | Exploit Issue Tracking Third Party Advisory |
| https://github.com/graphql/graphql-js/pull/3972 | Product |
| https://github.com/graphql/graphql-js/releases/tag/v16.8.1 | Release Notes |
| https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181 | Exploit Issue Tracking Patch Third Party Advisory |
| https://github.com/graphql/graphql-js/commit/f94b511386c7e47bd0380dcd56553dc063320226 | Patch |
| https://github.com/graphql/graphql-js/issues/3955 | Exploit Issue Tracking Third Party Advisory |
| https://github.com/graphql/graphql-js/pull/3972 | Product |
| https://github.com/graphql/graphql-js/releases/tag/v16.8.1 | Release Notes |
| https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181 | Exploit Issue Tracking Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/graphql/graphql-js/commit/f94b511386c7e47bd0380dcd56553dc063320226 - Patch | |
| References | () https://github.com/graphql/graphql-js/issues/3955 - Exploit, Issue Tracking, Third Party Advisory | |
| References | () https://github.com/graphql/graphql-js/pull/3972 - Product | |
| References | () https://github.com/graphql/graphql-js/releases/tag/v16.8.1 - Release Notes | |
| References | () https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181 - Exploit, Issue Tracking, Patch, Third Party Advisory |
22 Sep 2023, 14:05
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:graphql:graphql:*:*:*:*:*:node.js:*:* cpe:2.3:a:graphql:graphql:17.0.0:alpha2:*:*:*:node.js:*:* cpe:2.3:a:graphql:graphql:17.0.0:alpha1:*:*:*:node.js:*:* |
|
| CWE | CWE-400 | |
| References | (MISC) https://github.com/graphql/graphql-js/issues/3955 - Exploit, Issue Tracking, Third Party Advisory | |
| References | (MISC) https://github.com/graphql/graphql-js/pull/3972 - Product | |
| References | (MISC) https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181 - Exploit, Issue Tracking, Patch, Third Party Advisory | |
| References | (MISC) https://github.com/graphql/graphql-js/releases/tag/v16.8.1 - Release Notes | |
| References | (MISC) https://github.com/graphql/graphql-js/commit/f94b511386c7e47bd0380dcd56553dc063320226 - Patch | |
| First Time |
Graphql
Graphql graphql |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
20 Sep 2023, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-20 05:15
Updated : 2024-11-21 07:50
NVD link : CVE-2023-26144
Mitre link : CVE-2023-26144
CVE.ORG link : CVE-2023-26144
JSON object : View
Products Affected
graphql
- graphql
CWE
CWE-400
Uncontrolled Resource Consumption