MAL-2022-3447 Malicious code in graphql-ms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1579df6eb121dfcca4111c8ed7ad074f1b52d4847ad652e6b9cb71cea45015b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

This Week in Spring - September 27th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Its the last week of September, already! The years more done than not. The days are receding into darkness earlier. And the Pumpkin Spice Lattes are upon us. The darker and colder days are kind of a bummer, but Im stil excite...

GitHub: Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL api

An incorrect authorization vulnerability was found in GitHub Enterprise Server that allowed GitHub Apps to gain access to and modify most organization-level resources that are not tied to a repository, regardless of granted permissions. This vulnerability affected all versions of GitHub Enterpris...

GraphQL Cross-Site Request Forgery

GraphQL is an open-source query and manipulation language for APIs and a server-side runtime built to handle these queries on the application dataset. GraphQL servers often allow other Content-Type header values than application/json, and GET based requests for both queries and mutations. By...

My SpringOne 2022

It has taken me an embarrassingly long time to appreciate and understand that the devil is in the details regarding software development. Writing happy-path business logic isnt the hard part! Its the failure cases, observability, resilience, and process. Its security and other so-called...

CVE-2022-37734

A flaw was found in GraphQL Java. This flaw allows an attacker to use a malicious query in GraphQL to cause a denial of service due to inefficient lexer input validation...

Denial Of Services (DoS)

graphql-java is vulnerable to denial-of-service. The vulnerability exists because ANTLR lexing and parsing code is taking proportionally longer to get to the max token state which allows a remote attacker to send a malicious GraphQL query that consumes CPU resources resulting in an application...

GHSA-V62J-CXHH-FQ22 graphql-java vulnerable to Denial of Service via GraphQL query that consumes CPU resources

graphql-java before 19.0, 18.3, and 17.4 is vulnerable to Denial of Service. An attacker send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0, 18.3, and 17.4...

com.atlassian:nadel (>=0.15431504173, <=2025-06-04t01-38-48-82a5d0fc) potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (0.0.0-2024-11-28t03-45-06-a3fcfcb)

com.graphql-java:graphql-java MAVEN version 0.0.0-2024-11-28t03-45-06-a3fcfcb is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel =0.15431504173, =2025-06-04t01-38-48-82a5d0fc Source...

com.atlassian:nadel (>=0.18515136146, <=0.19875700101) potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (0.0.0-2025-10-15t00-55-01-694c3e1)

com.graphql-java:graphql-java MAVEN version 0.0.0-2025-10-15t00-55-01-694c3e1 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel =0.18515136146, =0.19875700101 Source cves:...

com.atlassian:nadel (0.21126711845) potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (0.0.0-2026-01-12t06-53-00-5a4e1dd)

com.graphql-java:graphql-java MAVEN version 0.0.0-2026-01-12t06-53-00-5a4e1dd is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel 0.21126711845 Source cves: CVE-2022-37734 Source...

com.atlassian:nadel (>=0.21161324682, <=0.23219532328) potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (0.0.0-2026-01-20t01-18-55-e5f21b8)

com.graphql-java:graphql-java MAVEN version 0.0.0-2026-01-20t01-18-55-e5f21b8 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel =0.21161324682, =0.23219532328 Source cves:...

com.atlassian:nadel (>=0.23276497139, <=0.32110907999) potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (0.0.0-2026-03-18t00-52-57-e53ab1a)

com.graphql-java:graphql-java MAVEN version 0.0.0-2026-03-18t00-52-57-e53ab1a is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel =0.23276497139, =0.32110907999 Source cves:...

dev.feddi:feddi-api-usage-client (>=2026-05-15-1133, <=2026-06-20-2000), dev.feddi:feddi-gateway-extension (>=2026-09-19-1518, <=2026-10-13-1539) +1 more potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (0.0.0-2026-05-12t01-33-43-16153d0)

com.graphql-java:graphql-java MAVEN version 0.0.0-2026-05-12t01-33-43-16153d0 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - dev.feddi:feddi-api-usage-client =2026-05-15-1133, =2026-09-19-1518,...

com.atlassian:nadel (>=0.34803828716, <=0.35806358795) potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (0.0.0-2026-08-23t10-34-47-acc4678)

com.graphql-java:graphql-java MAVEN version 0.0.0-2026-08-23t10-34-47-acc4678 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel =0.34803828716, =0.35806358795 Source cves:...

com.bretpatterson:schemagen-graphql (>=0.5.2, <=1.0.0-rc3), com.bretpatterson:schemagen-graphql-examples (>=0.5.2, <=1.0.0-rc3) +11 more potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (2.0.0)

com.graphql-java:graphql-java MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.bretpatterson:schemagen-graphql =0.5.2, =0.5.2, =0.5.2, =0.5.2, =0.7.0, =0.6.3, =0.1, =0.1, =0.1,...

com.eventsourcing:eventsourcing-graphql (0.4.1), com.graphql-java:graphql-java-annotations (>=0.10.0, <=0.12.0) +3 more potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (2.1.0)

com.graphql-java:graphql-java MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.eventsourcing:eventsourcing-graphql 0.4.1 - com.graphql-java:graphql-java-annotations =0.10.0,...

com.eventsourcing:eventsourcing-graphql (>=0.4.4, <=0.4.5), com.graphql-java:graphql-java-annotations (>=0.13.0, <=0.14.0) +13 more potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (2.2.0)

com.graphql-java:graphql-java MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.eventsourcing:eventsourcing-graphql =0.4.4, =0.13.0, =0.8.0, =1.1.0-2016-11-30t19-50-54, =1.0.5-1...

com.coxautodev:graphql-java-client (>=0.0.1, <=0.0.2), com.coxautodev:graphql-java-tools (>=1.0.0, <=2.1.2) +17 more potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (2.3.0)

com.graphql-java:graphql-java MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.coxautodev:graphql-java-client =0.0.1, =1.0.0, =1.1.1, =1.1.1, =0.0.1-snapshot, =0.10.0, =1.2.7,...

com.distelli.graphql:graphql-apigen (>=3.0.0, <=4.0.0), com.distelli.graphql:graphql-apigen-deps (>=3.0.0, <=4.0.0) +12 more potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (3.0.0)

com.graphql-java:graphql-java MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.distelli.graphql:graphql-apigen =3.0.0, =3.0.0, =3.0.2-alpha4, =4.0.0, =2.3.0, =3.3.0, =3.3.0,...