PT-2024-32674 · Unknown · Async-Graphql

Published 2024-10-03 · Updated 2026-05-06 · CVE-2024-47614

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions async-graphql versions prior to 7.0.10

Description The issue is related to the async-graphql library, a GraphQL server implemented in Rust, where it does not limit the number of directives for a field. This can lead to Service Disruption, Resource Exhaustion, and User Experience Degradation.

Recommendations For versions prior to 7.0.10, upgrade to v7.0.10 or use SchemaBuilder.limit directives to limit the maximum number of directives for a single field.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2024-47614

GHSA-5GC2-7C65-8FQ8

Affected Products

Async-Graphql

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47614.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-47614 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47614 · Security Note
• https://osv.dev/vulnerability/GHSA-5gc2-7c65-8fq8 · Vendor Advisory
• https://github.com/async-graphql/async-graphql/security/advisories/GHSA-5gc2-7c65-8fq8 · Note
• https://github.com/async-graphql/async-graphql/commit/7f1791488463d4e9c5adcd543962173e2f6cbd34 · Note
• https://github.com/async-graphql/async-graphql · Note
• https://twitter.com/dailycve/status/2052150638654509338 · Twitter Post
• https://twitter.com/cracbot/status/1843169478001250626 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1841881053071384775 · Twitter Post
• https://t.me/cvedetector/6899 · Telegram Post
• https://twitter.com/CVEnew/status/1841849531228451119 · Twitter Post
• https://twitter.com/cracbot/status/1843531831012143332 · Twitter Post