29 matches found
Improper Validation of Specified Type of Input
Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input through the built-in coerceString and coerceBool scalar coercion functions in scalars.go. An attacker can trigger request handling errors or crash the process by supplying a scalar variable...
CVE-2026-80051
github.com/graphql-go/graphql GraphQL for Go through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions scalars.go accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising t...
CVE-2026-80051
github.com/graphql-go/graphql GraphQL for Go through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions scalars.go accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising t...
EUVD-2026-65681
github.com/graphql-go/graphql GraphQL for Go through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions scalars.go accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising t...
CVE-2026-80051
github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions in scalars.go accept input whose type does not match the declared String , ID , or Boolean scalar instead of ra...
CVE-2026-80051
github.com/graphql-go/graphql GraphQL for Go through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions scalars.go accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising t...
CVE-2026-40476
graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs On² pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, causing excessive CPU...
CVE-2026-40476
CVE-2026-40476 affects graphql-go (Go GraphQL implementation) in version
CVE-2026-40476
graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs On² pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, causing excessive CPU...
EUVD-2022-6561
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2022-37315
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - graphql-go aka GraphQL for Go through 0.8.0 has infinite recursion in the type definition parser. CVE-2022-37315 Note that Nessus relies on the presence of the...
GO-2022-0942 Infinite recursion in parser in github.com/graphql-go/graphql
graphql-go aka GraphQL for Go has infinite recursion in the type definition parser...
CVE-2022-37315
graphql-go aka GraphQL for Go through 0.8.0 has infinite recursion in the type definition parser...
CVE-2022-37315
graphql-go aka GraphQL for Go through 0.8.0 has infinite recursion in the type definition parser...
UBUNTU-CVE-2022-37315
graphql-go aka GraphQL for Go through 0.8.0 has infinite recursion in the type definition parser...
CVE-2022-37315
graphql-go aka GraphQL for Go through 0.8.0 has infinite recursion in the type definition parser...
Design/Logic Flaw
graphql-go aka GraphQL for Go through 0.8.0 has infinite recursion in the type definition parser...
CVE-2022-37315
graphql-go aka GraphQL for Go through 0.8.0 has infinite recursion in the type definition parser...
CVE-2022-37315
graphql-go aka GraphQL for Go through 0.8.0 has infinite recursion in the type definition parser...
CVE-2022-37315
GraphQL-go (GraphQL for Go) up to v0.8.0 contains an infinite recursion in the type-definition parser. The CVE-2022-37315 entry notes this vulnerability impact, with an NVD CVSSv3.1 base score of 7.5 (HIGH) and network attack vector, no privileges required, no user interaction, and availability i...