Denial Of Service (DoS)

🗓️ 31 Jul 2024 09:34:33Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 19 Views

graphql-java vulnerability to Denial Of Service (DoS) due to improper handling of ExecutableNormalizedFields (ENFs) in introspection querie

Reporter	Title	Published	Views	Family All 57
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses IBM WebSphere Application Server Liberty which is vulnerable to CVE-2024-40094.	10 Apr 202510:14	–	ibm
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for July 2025.	7 Aug 202508:58	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in IBM WebSphere Application Server Liberty and Java may affect IBM Storage Protect for Virtual Environments (Data Protection for VMware and Data Protection for Hyper-V)	20 Jun 202518:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Tivoli Netcool Impact	24 Oct 202517:27	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in GraphQL Java affects IBM watsonx Assistant for IBM Cloud Pak for Data	5 Feb 202520:35	–	ibm
IBM Security Bulletins	Security Bulletin: Denial of Service vulnerability in WebSphere Liberty affects IBM SPSS Analytic Server (CVE-2024-40094)	7 Mar 202504:26	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in IBM WebSphere Application Server Liberty and Java may affect IBM Storage Protect for Space Management	20 Jun 202518:36	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in graphql-java-20.1.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2024-40094)	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics is affected by vulnerabilities in IBM® Java™ Version 8, IBM® Semeru Runtime and IBM® Websphere Application Server Liberty	27 Mar 202520:25	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty	13 Feb 202514:44	–	ibm

Vulners

Node

graphql-java graphql-javaRange0.0.0-2021-05-04T21-12-03-d3ac10b0–19.10java

graphql-java graphql-javaRange20.0–20.8java

graphql-java graphql-javaRange21.0–21.4java

graphql-java graphql-javaRange2018-06-04T04-23-07–230521-nf-executionjava

graphql-java graphql-javaRangevTEST–0.0.0-2024-03-26T07-23-38-76b0d0bjava

Source	Link
github	www.github.com/graphql-java/graphql-java/releases/tag/v21.5
github	www.github.com/graphql-java/graphql-java/releases/tag/v20.9
github	www.github.com/graphql-java/graphql-java/commit/469caf6ee600ab6709ad5e8a06f371fe2ef3b8dd
github	www.github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a
github	www.github.com/graphql-java/graphql-java/commit/fc6f304e66cab18b6d06a80c7009524938939a03
github	www.github.com/graphql-java/graphql-java/pull/3539
github	www.github.com/graphql-java/graphql-java/releases/tag/v19.11
github	www.github.com/graphql-java/graphql-java/commit/16c159111507ef04d7e1839b2c23281d90c42b2b
github	www.github.com/graphql-java/graphql-java/discussions/3641
github	www.github.com/advisories/GHSA-h9mq-f6q5-6c8m

31 Jul 2024 22:16Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.15.3

EPSS0.1753

SSVC