In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.
References
| Link | Resource |
|---|---|
| https://github.com/graphql-java/graphql-java/pull/3112 | Issue Tracking Patch |
| https://github.com/graphql-java/graphql-java/releases/tag/v17.5 | Release Notes |
| https://github.com/graphql-java/graphql-java/releases/tag/v18.4 | Release Notes |
| https://github.com/graphql-java/graphql-java/releases/tag/v19.4 | Release Notes |
| https://github.com/graphql-java/graphql-java/releases/tag/v20.1 | Release Notes |
| https://github.com/graphql-java/graphql-java/pull/3112 | Issue Tracking Patch |
| https://github.com/graphql-java/graphql-java/releases/tag/v17.5 | Release Notes |
| https://github.com/graphql-java/graphql-java/releases/tag/v18.4 | Release Notes |
| https://github.com/graphql-java/graphql-java/releases/tag/v19.4 | Release Notes |
| https://github.com/graphql-java/graphql-java/releases/tag/v20.1 | Release Notes |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/graphql-java/graphql-java/pull/3112 - Issue Tracking, Patch | |
| References | () https://github.com/graphql-java/graphql-java/releases/tag/v17.5 - Release Notes | |
| References | () https://github.com/graphql-java/graphql-java/releases/tag/v18.4 - Release Notes | |
| References | () https://github.com/graphql-java/graphql-java/releases/tag/v19.4 - Release Notes | |
| References | () https://github.com/graphql-java/graphql-java/releases/tag/v20.1 - Release Notes |
Information
Published : 2023-03-27 01:15
Updated : 2024-11-21 07:56
NVD link : CVE-2023-28867
Mitre link : CVE-2023-28867
CVE.ORG link : CVE-2023-28867
JSON object : View
Products Affected
graphql-java
- graphql-java
CWE
CWE-770
Allocation of Resources Without Limits or Throttling