CVEvulnerability
CVE-2023-28867
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-03-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-770
Description
In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.
Affected configurations
• graphql-java graphql-java (< 17.5)
• graphql-java graphql-java (>= 18.0 < 18.4)
• graphql-java graphql-java (>= 19.0 < 19.4)
• graphql-java graphql-java 20.0
Related
Weakness · CWE (1)
- CWE-770 Allocation of Resources Without Limits or Throttling weakness
References
- https://github.com/graphql-java/graphql-java/pull/3112 Issue Tracking, Patch
- https://github.com/graphql-java/graphql-java/releases/tag/v17.5 Release Notes
- https://github.com/graphql-java/graphql-java/releases/tag/v18.4 Release Notes
- https://github.com/graphql-java/graphql-java/releases/tag/v19.4 Release Notes
- https://github.com/graphql-java/graphql-java/releases/tag/v20.1 Release Notes
- https://github.com/graphql-java/graphql-java/pull/3112 Issue Tracking, Patch
- https://github.com/graphql-java/graphql-java/releases/tag/v17.5 Release Notes
- https://github.com/graphql-java/graphql-java/releases/tag/v18.4 Release Notes
- https://github.com/graphql-java/graphql-java/releases/tag/v19.4 Release Notes
- https://github.com/graphql-java/graphql-java/releases/tag/v20.1 Release Notes