PT-2024-28780 · Unknown · Graphql-Java

CVE-2024-40094 · Published 2024-07-30 · Updated 2026-06-17

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GraphQL Java versions prior to 21.5 GraphQL Java version 20.9 GraphQL Java version 19.11

Description The issue is related to the improper consideration of ExecutableNormalizedFields (ENFs) in preventing denial of service via introspection queries. This can lead to a denial of service.

Recommendations For versions prior to 21.5, update to version 21.5 or later to resolve the issue. For version 20.9, no additional action is required as it is a fixed version. For version 19.11, no additional action is required as it is a fixed version.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CLEANSTART-2026-DD05788

CLEANSTART-2026-KU61465

CLEANSTART-2026-LE11246

CLEANSTART-2026-RN56220

CLEANSTART-2026-VH41554

CVE-2024-40094

GHSA-H9MQ-F6Q5-6C8M

Affected Products

Graphql-Java

References · 254

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40094.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59419 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-23015 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-48924 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2024-40094 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-VH41554 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53864 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33870 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1320 · Security Note
• https://osv.dev/vulnerability/GHSA-h9mq-f6q5-6c8m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21452 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42587 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-41973 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42779 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-41881 · Security Note