CVE-2026-35401

Saleor has a resource exhaustion vulnerability in GraphQL queries

State: Published
Severity: 7.5 High
Published: Apr 8, 2026
Updated: Apr 8, 2026
Reserved: Apr 2, 2026

Description

Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a malicious actor can include many GraphQL mutations or queries in a single API call using aliases or chaining multiple mutations, resulting in resource exhaustion. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
saleorsaleor	>= 2.0.0, < 3.20.118Affected >= 3.21.0-a.0, < 3.21.54Affected >= 3.22.0-a.0, < 3.22.47Affected >= 3.23.0-a.0, < 3.23.0a3Affected

References

https://github.com/saleor/saleor/security/advisories/GHSA-gqqv-xwx3-jj4h

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.