PT-2026-30331 · Directus · Directus

Liyander · Published 2026-04-04 · Updated 2026-04-06 · CVE-2026-35441

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.17.0

Description Directus GraphQL endpoints ('/graphql' and '/graphql/system') did not prevent repeated execution of expensive relational queries through GraphQL aliasing. An authenticated user could exploit this to cause CPU, memory, and I/O exhaustion, potentially degrading or crashing the service. The issue stemmed from a lack of resolver deduplication within a single request, allowing an attacker to multiply database load linearly with the number of aliases used. Rate limiting was disabled by default, exacerbating the problem. Any authenticated user, even with minimal permissions, could trigger this condition.

Recommendations Update to version 11.17.0 or later.

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2026-35441

GHSA-PH52-67FQ-75WJ

Affected Products

Directus

References · 5

• https://github.com/directus/directus/security/advisories/GHSA-ph52-67fq-75wj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35441 · Security Note
• https://osv.dev/vulnerability/GHSA-ph52-67fq-75wj · Vendor Advisory
• https://github.com/directus/directus · Note
• https://twitter.com/CVEnew/status/2041282869981810907 · Twitter Post