5915 matches found
SUSE CVE-2026-75508
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's maxtokens limit in Parser.advancelexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and...
PT-2026-132761
The graphql and graphql sync functions of juniper hyper read the whole body of a POST request into memory before they parsed the body. The functions had no limit on the size of the body. A client could thus send a large body and exhaust the memory of the server. The request needs no authenticatio...
PT-2026-132762
The parser of juniper called itself once for each level of nesting in a GraphQL document. The parser had no limit on the nesting depth. Deeply nested selection sets, input values, and list types thus overflowed the stack of the thread that parsed the document. Validation and execution followed...
CVE-2026-118665: Insufficient Session Expiration
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...
PT-2026-129186
Name of the Vulnerable Software and Affected Versions @graphql-tools/executor-legacy-ws versions prior to 1.1.36 Description In the buildWSLegacyExecutor function within packages/executors/legacy-ws/src/index.ts, the executorConnectionParams object is retained in the closure scope after a...
PT-2026-129187
Name of the Vulnerable Software and Affected Versions @graphql-tools/executor-legacy-ws versions prior to 1.1.36 Description In the buildWSLegacyExecutor function, the software reuses a single WebSocket and replaces its websocket.onmessage handler whenever a new overlapping subscription starts. T...
PT-2026-132763
Several parts of juniper did work that grew faster than the size of the GraphQL document. A small document could thus use seconds of CPU time or gigabytes of memory. The requests need no authentication. - OverlappingFieldsCanBeMerged compared all pairs of fields with the same response name. The...
CVE-2026-118666: Exposure of Sensitive Information to an Unauthorized Actor
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...
Arda TANRIKULU graphql-tools information disclosure vulnerability
Arda TANRIKULU: Versions of graphql-tools prior to 9.0.36 and versions of the GraphQL Tools legacy WebSocket executor package prior to 1.1.36 contain an information disclosure vulnerability. This vulnerability arises because buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuse...
CLSA-2026-1793113298 TuxCare security update for @graphql-tools/utils (1 CVE)
TuxCare rebuilt @graphql-tools/utils to address 1 CVE. Fixed in 10.11.0-tuxcare.1...
CLSA-2026-1793113102 TuxCare security update for @graphql-tools/executor-legacy-ws (1 CVE)
TuxCare rebuilt @graphql-tools/executor-legacy-ws to address 1 CVE. Fixed in 0.0.11-tuxcare.1...
CLSA-2026-1793113090 TuxCare security update for @graphql-tools/utils (1 CVE)
TuxCare rebuilt @graphql-tools/utils to address 1 CVE. Fixed in 12.0.0-tuxcare.1...
CLSA-2026-1793098698 TuxCare security update for @graphql-tools/utils (1 CVE)
TuxCare rebuilt @graphql-tools/utils to address 1 CVE. Fixed in 11.2.2-tuxcare.2...
CLSA-2026-1793047238 TuxCare security update for @graphql-tools/utils (1 CVE)
TuxCare rebuilt @graphql-tools/utils to address 1 CVE. Fixed in 10.9.1-tuxcare.1...
CLSA-2026-1793047143 TuxCare security update for @graphql-tools/utils (1 CVE)
TuxCare rebuilt @graphql-tools/utils to address 1 CVE. Fixed in 8.13.1-tuxcare.1...
CLSA-2026-1793047049 TuxCare security update for @graphql-tools/utils (1 CVE)
TuxCare rebuilt @graphql-tools/utils to address 1 CVE. Fixed in 9.2.1-tuxcare.1...
CLSA-2026-1793023448 TuxCare security update for @graphql-tools/utils (1 CVE)
TuxCare rebuilt @graphql-tools/utils to address 1 CVE. Fixed in 8.12.0-tuxcare.1...
CLSA-2026-1793022219 TuxCare security update for @graphql-tools/utils (1 CVE)
TuxCare rebuilt @graphql-tools/utils to address 1 CVE. Fixed in 8.8.0-tuxcare.1...