Lucene search

GoogleOSV:GHSA-2HMF-46V7-V6FX

HistoryJun 12, 2024 - 9:31 p.m.

gqlparser denial of service vulnerability via the parserDirectives function

2024-06-1221:31:19

Google

osv.dev

gqlparser

denial of service

vulnerability

parserdirectives

remote attacker

crafted script

software

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

An issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the parserDirectives function.

CPENameOperatorVersion
github.com/vektah/gqlparserlt2.5.14
github.com/vektah/gqlparser/v2lt2.5.14

CPE	Name	Operator	Version
	github.com/vektah/gqlparser	lt	2.5.14
	github.com/vektah/gqlparser/v2	lt	2.5.14

References

gist.github.com/uvzz/d3ed9d4532be16ec1040a2cf3dfec8d1

github.com/99designs/gqlgen/issues/3118

github.com/vektah/gqlparser

github.com/vektah/gqlparser/blob/master/parser/query.go#L316

github.com/vektah/gqlparser/commit/36a3658873bf5a107f42488dfc392949cdd02977

nvd.nist.gov/vuln/detail/CVE-2023-49559