CVE-2022-21708

Katalog CVE

CVSS 6.5 · Medium EPSS 1,2%

Kerentanan Uncontrolled Resource Consumption pada graphql-go project graphql-go. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows. This in turn could potentially compromise the ability of the server to serve data to its users. The issue has been patched in version `v1.3.0`. The only known workaround for this issue is to disable the `graphql.MaxDepth` option from your schema which is not recommended.

Rincian

Terbit di NVD

21 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-674: Uncontrolled Recursion

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 68,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/graph-gophers/graphql-go/commit/eae31ca73eb3473c544710955d1dbebc22605bfe patch · advisory pihak ketiga
• https://github.com/graph-gophers/graphql-go/security/advisories/GHSA-mh3m-8c74-74xh advisory pihak ketiga