GitHub Advisoryadvisory · Maven

GHSA-h9mq-f6q5-6c8m GraphQL Java does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service

HIGH Published 2024-07-30 Modified 2024-07-30 Official page ↗
Aliases
CVE-2024-40094
Ecosystem
Maven
Packages
com.graphql-java:graphql-java
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2024-07-30

Affected packages

• Maven com.graphql-java:graphql-java: < 19.11 → fixed in 19.11 • Maven com.graphql-java:graphql-java: >= 20.0, < 20.9 → fixed in 20.9 • Maven com.graphql-java:graphql-java: >= 21.0, < 21.5 → fixed in 21.5

Description

GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.

Related

Alias · CVE (1)

  • CVE-2024-40094 GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References