Lucene search
GoogleOSV:GHSA-9PV7-VFVM-6VR7HistorySep 20, 2023 - 6:30 a.m.
graphql Uncontrolled Resource Consumption vulnerability
2023-09-2006:30:50
Google
osv.dev
22
graphql
vulnerability
denial of service
insufficient checks
system performance
parsing large queries
0.001 Low
EPSS
Percentile
20.4%
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance.
Note: It was not proven that this vulnerability can crash the process.
References
github.com/graphql/graphql-js
github.com/graphql/graphql-js/commit/8f4c64eb6a7112a929ffeef00caa67529b3f2fcf
github.com/graphql/graphql-js/issues/3955
github.com/graphql/graphql-js/pull/3972
github.com/graphql/graphql-js/releases/tag/v16.8.1
nvd.nist.gov/vuln/detail/CVE-2023-26144
security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181
Related
cvelist
cvelist
CVE-2023-26144
2023-09-20 05:00:02
redhatcve
redhatcve
CVE-2023-26144
2023-09-21 04:54:21
debiancve
debiancve
CVE-2023-26144
2023-09-20 05:15:39
github
github
graphql Uncontrolled Resource Consumption vulnerability
2023-09-20 06:30:50
prion
prion
Input validation
2023-09-20 05:15:00
veracode
veracode
Denial Of Service
2023-09-21 09:53:26
ubuntucve
ubuntucve
CVE-2023-26144
2023-09-20 00:00:00
cve
cve
CVE-2023-26144
2023-09-20 05:15:39
osv
osv
CVE-2023-26144
2023-09-20 05:15:39
ibm
ibm
Security Bulletin: IBM Edge Application Manager 4.5.3 addresses the security vulnerabilities listed in the CVEs below.
2023-11-29 21:30:08
Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
2024-01-03 18:06:03
Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOps
2023-10-25 20:24:23