graphql-java: crafted GraphQL query causes stack consumption

A flaw was found in GraphQL Java. This issue may allow a malicious user to send a crafted GraphQL query that causes stack consumption, causing a denial of service...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is vulnerable to a denial of service due to GraphQL Java (CVE-2023-28867)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is vulnerable to a denial of service due to GraphQL Java CVE-2023-28867 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to a denial of service due to GraphQL Java (CVE-2023-28867)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to a denial of service due to GraphQL Java CVE-2023-28867 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Version...

Denial Of Services (DoS)

graphql-java is vulnerable to Denial Of Services DoS. An attacker can send a maliciously crafted GraphQL query that causes excessive stack consumption, which can lead to an application crash...

CVE-2023-28867

A flaw was found in GraphQL Java. This issue may allow a malicious user to send a crafted GraphQL query that causes stack consumption, causing a denial of service...

GraphQL Java vulnerable to stack consumption

In GraphQL Java aka graphql-java before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135...

GHSA-P4QX-6W5P-4RJ2 GraphQL Java vulnerable to stack consumption

In GraphQL Java aka graphql-java before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.4.0, <=6.4.7), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.4.0, <=6.4.7) +325 more potentially affected by CVE-2023-28867 via com.graphql-java:graphql-java (>=19.0, <=19.3)

com.graphql-java:graphql-java MAVEN version =19.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =2.0.4, =14.3.0, =17.5.0 - com.datasqrl:sqrl-base 0.6.0 - com.datasqrl:sqrl-calcite 0.6.0 and more Source cves: CVE-2023-28867 Source advisory: OSV:GHSA-P4QX-6W5P-4RJ2...

com.atlassian:nadel (>=2022-01-19t23-18-30-adbad461, <=2023-03-23t00-25-09-43ae18bf), com.atlassian:nadel-api (>=2022-01-19t23-18-30-adbad461, <=2022-03-22t05-05-01-a5d0b804) +4 more potentially affected by CVE-2023-28867 via com.graphql-java:graphql-java (>=0.0.0-2021-06-27t12-22-33-cd2bab76, <=0.0.0-2022-10-29t03-41-04-bb4a3b2b)

com.graphql-java:graphql-java MAVEN version =0.0.0-2021-06-27t12-22-33-cd2bab76, =2022-01-19t23-18-30-adbad461, =2022-01-19t23-18-30-adbad461, =2022-01-19t23-18-30-adbad461, =2022-01-19t23-18-30-adbad461, =2022-01-19t23-18-30-adbad461, =2022-04-05t04-35-54-29b76c29 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.0.0, <=6.2.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.0.3, <=6.2.5) +822 more potentially affected by CVE-2023-28867 via com.graphql-java:graphql-java (>=1.3, <=17.4)

com.graphql-java:graphql-java MAVEN version =1.3, =6.0.0, =6.0.3, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.0, =6.0.0, =6.0.0, =6.0.3, =0.1.0, =1.0.0, =2.8.5, =1.3.0, =1.1.0, =2.27.0 and more Source cves: CVE-2023-28867 Source advisory: OSV:GHSA-P4QX-6W5P-4RJ2...

com.atlassian:nadel (>=2022-01-19t23-18-30-adbad461, <=2023-03-23t00-25-09-43ae18bf), com.atlassian:nadel-api (>=2022-01-19t23-18-30-adbad461, <=2022-03-22t05-05-01-a5d0b804) +4 more potentially affected by CVE-2023-28867 via com.graphql-java:graphql-java (>=0.0.0-2021-06-27t12-22-33-cd2bab76, <=0.0.0-2022-10-29t03-41-04-bb4a3b2b)

com.graphql-java:graphql-java MAVEN version =0.0.0-2021-06-27t12-22-33-cd2bab76, =2022-01-19t23-18-30-adbad461, =2022-01-19t23-18-30-adbad461, =2022-01-19t23-18-30-adbad461, =2022-01-19t23-18-30-adbad461, =2022-01-19t23-18-30-adbad461, =2022-04-05t04-35-54-29b76c29 -...

cn.asany.chaos:jfantasy-graphql (>=2.10.0, <=2.11.0), com.apollographql.federation:federation-graphql-java-support (>=2.0.2, <=2.0.3) +222 more potentially affected by CVE-2023-28867 via com.graphql-java:graphql-java (>=18.0, <=18.3)

com.graphql-java:graphql-java MAVEN version =18.0, =2.10.0, =2.0.2, =6.0.0-alpha.6, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =0.1.11, =1.0.1 and more Source cves: CVE-2023-28867...

cn.asany.chaos:jfantasy-graphql (>=2.10.0, <=2.11.0), com.apollographql.federation:federation-graphql-java-support (>=2.0.2, <=2.0.3) +222 more potentially affected by CVE-2023-28867 via com.graphql-java:graphql-java (>=18.0, <=18.3)

com.graphql-java:graphql-java MAVEN version =18.0, =2.10.0, =2.0.2, =6.0.0-alpha.6, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =0.1.11, =1.0.1 and more Source cves: CVE-2023-28867...

ai.stapi:graphql-api (>=0.0.11, <=0.2.3), be.ugent.solidlab:shapeshift (0.0.1) +97 more potentially affected by CVE-2023-28867 via com.graphql-java:graphql-java (20.0)

com.graphql-java:graphql-java MAVEN version 20.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - ai.stapi:graphql-api =0.0.11, =1.6.9, =1.6.9, =2.0.0, =1.18.10, =1.18.10, =1.18.10, =1.18.10, =1.18.10...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.4.0, <=6.4.7), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.4.0, <=6.4.7) +325 more potentially affected by CVE-2023-28867 via com.graphql-java:graphql-java (>=19.0, <=19.3)

com.graphql-java:graphql-java MAVEN version =19.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =2.0.4, =14.3.0, =17.5.0 - com.datasqrl:sqrl-base 0.6.0 - com.datasqrl:sqrl-calcite 0.6.0 and more Source cves: CVE-2023-28867 Source advisory: GHSA-P4QX-6W5P-4RJ2...

ai.stapi:graphql-api (>=0.0.11, <=0.2.3), be.ugent.solidlab:shapeshift (0.0.1) +97 more potentially affected by CVE-2023-28867 via com.graphql-java:graphql-java (20.0)

com.graphql-java:graphql-java MAVEN version 20.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - ai.stapi:graphql-api =0.0.11, =1.6.9, =1.6.9, =2.0.0, =1.18.10, =1.18.10, =1.18.10, =1.18.10, =1.18.10...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.0.0, <=6.2.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.0.3, <=6.2.5) +822 more potentially affected by CVE-2023-28867 via com.graphql-java:graphql-java (>=1.3, <=17.4)

com.graphql-java:graphql-java MAVEN version =1.3, =6.0.0, =6.0.3, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.0, =6.0.0, =6.0.0, =6.0.3, =0.1.0, =1.0.0, =2.8.5, =1.3.0, =1.1.0, =2.27.0 and more Source cves: CVE-2023-28867 Source advisory: GHSA-P4QX-6W5P-4RJ2...

CVE-2023-28867

In GraphQL Java aka graphql-java before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135...

Design/Logic Flaw

In GraphQL Java aka graphql-java before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135...

CVE-2023-28867: Allocation of Resources Without Limits or Throttling

In GraphQL Java aka graphql-java before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135...