PT-2026-31347 · Saleor · Saleor

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-33756

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Saleor versions 2.0.0 through 3.22.47

Description Saleor, an e-commerce platform, allowed an unauthenticated attacker to exhaust resources by sending a single HTTP request containing multiple GraphQL operations. The platform supported query batching via a JSON array of operations but lacked a limit on the number of operations allowed. This bypassed the per-query complexity limit.

Recommendations Update to version 3.23.0a3 or later. Update to version 3.22.47 or later. Update to version 3.21.54 or later. Update to version 3.20.118 or later.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-33756

Affected Products

Saleor

References · 8

• https://github.com/saleor/saleor/commit/cdb66da97abb7c86939e384914cd8d9194f378e8 · Patch
• https://github.com/saleor/saleor/commit/e42aa4d6e588982e78942b033af051c8ec8f43fa · Patch
• https://github.com/saleor/saleor/commit/d6a94e95bd77f3f733fa66afd1b1ac72e863ca2a · Patch
• https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64 · Patch
• https://github.com/saleor/saleor/security/advisories/GHSA-24jw-f244-qfpp · Vendor Advisory
• https://github.com/saleor/saleor/commit/f0371bdd4cafcc841f1a9e7049cead6133bf7464 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33756 · Security Note
• https://twitter.com/CVEnew/status/2041975621039841324 · Twitter Post