PT-2024-13747 · Unknown · Vektah Gqlparser

Yuval Moravchick · Published 2024-06-12 · Updated 2025-06-18 · CVE-2023-49559

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions vektah gqlparser version 2.5.10

Description An issue in the vektah gqlparser open-source-library allows a remote attacker to cause a denial of service via a crafted script to the parserDirectives function. This issue can be exploited to overload the parser, resulting in a denial of service.

Recommendations For version 2.5.10, consider disabling the parserDirectives function as a temporary workaround until a patch is available. Restrict access to the parseDirectives function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2023-49559

GHSA-2HMF-46V7-V6FX

GO-2024-2920

Affected Products

Vektah Gqlparser

References · 14

• https://osv.dev/vulnerability/GO-2024-2920 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49559 · Security Note
• https://osv.dev/vulnerability/GHSA-2hmf-46v7-v6fx · Vendor Advisory
• https://github.com/99designs/gqlgen/issues/3118 · Note
• https://github.com/vektah/gqlparser/commit/36a3658873bf5a107f42488dfc392949cdd02977 · Note
• https://github.com/vektah/gqlparser · Note
• https://github.com/vektah/gqlparser/blob/master/parser/query.go#L316 · Note
• https://t.me/cvenotify/102940 · Telegram Post
• https://t.me/aptreports/19627 · Telegram Post
• https://t.me/cvenotify/83071 · Telegram Post
• https://twitter.com/opsmatters_uk/status/1836568790055673890 · Twitter Post
• https://twitter.com/opsmatters_uk/status/1840900626269479391 · Twitter Post
• https://github.com/advisories/GHSA-2hmf-46v7-v6fx · Note
• https://gist.github.com/uvzz/d3ed9d4532be16ec1040a2cf3dfec8d1 · Note