PT-2026-41402 · Rubygems · Graphql

Publicado 2026-05-05 · Atualizado 2026-05-05

OSV

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

GraphQL-Ruby's max query string tokens configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached.

In patched versions, the Ruby lexer does count these tokens.

GraphQL-CParser is not affected by this problem.

max query string tokens was introduced in v2.3.1. Each 2.x version has received a new patch release for including a fix.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

GHSA-3H96-34P3-XM76

Produtos afetados

Graphql

Referências · 3

• https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-3h96-34p3-xm76 · Nota
• https://github.com/rmosolgo/graphql-ruby · Nota
• https://osv.dev/vulnerability/GHSA-3h96-34p3-xm76 · Aviso do Fabricante