QwikSec

Security Database

CVE

CWE

Training

CVE-2023-26144

Published: Sep 20, 2023

Modified: Sep 24, 2024

PUBLISHED

CVSS v3.1

5.3

MEDIUM

Description

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not proven that this vulnerability can crash the process.

Vendor	Product	Versions
n/a	graphql	affected `16.3.0 - < 16.8.1`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

References

https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181

https://github.com/graphql/graphql-js/pull/3972

https://github.com/graphql/graphql-js/issues/3955

https://github.com/graphql/graphql-js/commit/f94b511386c7e47bd0380dcd56553dc063320226

https://github.com/graphql/graphql-js/releases/tag/v16.8.1

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.