CVE-2023-26144

State: Published
Severity: 5.3 Medium
Published: Sep 20, 2023
Updated: Sep 24, 2024
Reserved: Feb 20, 2023

Description

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not proven that this vulnerability can crash the process.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P	snyk

Weaknesses

CWE-400 Denial of Service (DoS)

Affected Products

Product	Versions
graphqln/a	16.3.0 to before 16.8.1Affected

References

https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181
https://github.com/graphql/graphql-js/pull/3972
https://github.com/graphql/graphql-js/issues/3955
https://github.com/graphql/graphql-js/commit/f94b511386c7e47bd0380dcd56553dc063320226
https://github.com/graphql/graphql-js/releases/tag/v16.8.1

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.