Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the GraphQL API when a large number of mutations or queries are included in a single request using aliases or by chaining multiple mutations. An attacker can cause excessive...

CVE-2026-35401

Saleor (e-commerce platform) contains a resource exhaustion vulnerability in GraphQL handling affecting 2.0.0 up to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118. A malicious actor can exceed resource limits by including many GraphQL mutations or queries in a single API call via aliases or by c...