CVE-2026-1173
birkir prime GraphQL Array Based Query Batch graphql denial of service
- State
- Published
- Severity
- 6.9 Medium
- Published
- Jan 19, 2026
- Updated
- Feb 23, 2026
- Reserved
- Jan 19, 2026
Description
A vulnerability was found in birkir prime up to 0.4.0.beta.0. The impacted element is an unknown function of the file /graphql of the component GraphQL Array Based Query Batch Handler. The manipulation results in denial of service. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-404 Denial of Service
Affected Products
| Product | Versions |
|---|---|
primebirkir |
|
References
- VDB-341767 | birkir prime GraphQL Array Based Query Batch graphql denial of servicevdb-entrytechnical-description
- VDB-341767 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #731104 | birkir prime <=0.4.0 Graphql Array Based Query Batching Vulnerabilitythird-party-advisory
- https://github.com/birkir/prime/issues/544exploitissue-tracking
- https://github.com/birkir/prime/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.