Description

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not proven that this vulnerability can crash the process.

Remediation

References

https://github.com/graphql/graphql-js/commit/f94b511386c7e47bd0380dcd56553dc063320226

https://github.com/graphql/graphql-js/issues/3955

https://github.com/graphql/graphql-js/pull/3972

https://github.com/graphql/graphql-js/releases/tag/v16.8.1

https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181

Related Vulnerabilities

CVE-2020-5258 Vulnerability in maven package org.webjars.bower:dojo

CVE-2023-37946 Vulnerability in maven package org.openshift.jenkins:openshift-login

CVE-2021-23395 Vulnerability in npm package nedb

CVE-2021-3801 Vulnerability in npm package prismjs

CVE-2020-6427 Vulnerability in npm package electron

Severity

Medium

Classification

CWE-400 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Tags

Patch Exploit Issue Tracking Third Party Advisory Product Release Notes