PT-2023-20522 · Graphql+1 · Graphql+1

Tadhg Lewis · Publicado 2023-09-19 · Atualizado 2026-05-05 · CVE-2023-26144

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions graphql versions 16.3.0 through 16.8.1

Description The issue is related to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This allows an attacker to degrade system performance. It was not proven that this vulnerability can crash the process.

Recommendations For versions 16.3.0 through 16.8.1, consider updating to a version after 16.8.1 to resolve the issue. As a temporary workaround, consider restricting the size of queries to prevent large queries from being parsed.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2023-26144

GHSA-9PV7-VFVM-6VR7

Produtos afetados

Debian

Graphql

Referências · 21

• 🔥 https://github.com/graphql/graphql-js/issues/3955 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181 · Exploit
• https://github.com/graphql/graphql-js/pull/3972 · Nota
• https://github.com/graphql/graphql-js/commit/f94b511386c7e47bd0380dcd56553dc063320226 · Correção
• https://github.com/graphql/graphql-js/releases/tag/v16.8.1 · Nota
• https://github.com/graphql/graphql-js · Nota
• https://github.com/graphql/graphql-js/commit/8f4c64eb6a7112a929ffeef00caa67529b3f2fcf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-26144 · Nota de Segurança
• https://t.me/cvenotify/58426 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-26144 · Aviso do Fabricante
• https://t.me/cvenotify/58128 · Publicação no Telegram
• https://twitter.com/dailycve/status/2051485760721764358 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-9pv7-vfvm-6vr7 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1704449035258445960 · Publicação no Twitter
• https://security-tracker.debian.org/tracker/CVE-2023-26144 · Aviso do Fabricante