PT-2026-23759 · Mercurius · Mercurius

Tinkanet · Publicado 2026-03-06 · Atualizado 2026-03-12 · CVE-2026-30241

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Mercurius versions prior to 16.8.0

Description Mercurius does not properly enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check functions as expected for HTTP queries and mutations, but subscription queries bypass this validation. This allows a remote client to send excessively nested subscription queries via WebSocket, circumventing the intended depth restriction. In schemas containing recursive types, this can result in a denial of service due to exponential data resolution with each subscription event.

Recommendations Update to version 16.8.0 or later. Disable subscriptions and queries over WebSocket.

Exploit

Correção

DoS

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-30241

GHSA-M4H2-MJFM-MP55

Produtos afetados

Mercurius

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30241.json · Exploit
• https://github.com/mercurius-js/mercurius/commit/5b56f60f4b0d60780b0ff499a479bd830bdd6986 · Correção
• https://github.com/mercurius-js/mercurius/security/advisories/GHSA-m4h2-mjfm-mp55 · Aviso do Fabricante
• https://github.com/mercurius-js/mercurius · Nota
• https://osv.dev/vulnerability/CVE-2026-30241 · Aviso do Fabricante
• https://t.me/CVEtracker/46663 · Publicação no Telegram
• https://t.me/cveNotify/155297 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-m4h2-mjfm-mp55 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-30241 · Nota de Segurança
• https://twitter.com/CVEnew/status/2030385150610042893 · Publicação no Twitter