What is the CVSS score of CVE-2026-35401?

CVE-2026-35401 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Saleor are affected by CVE-2026-35401?

Saleor e-commerce platform versions 2.0.0 through 3.22.x are vulnerable to unauthenticated denial-of-service attacks via GraphQL query complexity abuse, allowing attackers to exhaust server resources…. A patch is available.

How to fix or mitigate CVE-2026-35401?

Within 24 hours: identify all Saleor instances in production and verify current version against the affected range (2.0.0-3.22.x). Within 7 days: apply vendor-released patch to upgrade beyond version 3.22.x and validate patch deployment in staging. Within 30 days: implement rate limiting and query complexity limits at the GraphQL API layer, and monitor API logs for suspicious alias-based or chained mutation patterns.

Saleor CVE-2026-35401

EUVD-2026-20532 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-04-08 GitHub_M

Denial Of Service Saleor

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 20, 2026 - 20:07 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:01 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.23.0a3,3.20.118,3.22.47

EUVD ID Assigned

Apr 08, 2026 - 19:31 euvd

EUVD-2026-20532

Analysis Generated

Apr 08, 2026 - 19:31 vuln.today

CVE Published

Apr 08, 2026 - 17:22 nvd

HIGH 7.5

DescriptionGitHub Advisory

Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a malicious actor can include many GraphQL mutations or queries in a single API call using aliases or chaining multiple mutations, resulting in resource exhaustion. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

AnalysisAI

GraphQL query complexity abuse in Saleor e-commerce platform enables unauthenticated denial-of-service through alias-based or chained mutation requests. Attackers craft single API calls containing excessive GraphQL operations (mutations/queries) via aliasing or chaining, exhausting server resources and disrupting service availability. Affects Saleor versions 2.0.0 through 3.22.x, with no authentication required for exploitation. Low observed exploitation activity (EPSS <1%). No public exploit identified at time of analysis.

Technical ContextAI

CWE-770 resource allocation flaw permits unbounded GraphQL operation batching within single HTTP requests. Absence of query complexity analysis or depth/batch limits allows attackers to bypass rate-limiting through GraphQL alias syntax (e.g., alias1:mutation, alias2:mutation) or sequential mutation chaining. Saleor's GraphQL API processes all operations synchronously without resource throttling, enabling computational exhaustion attacks against web and application tiers.

RemediationAI

Vendor-released patches: upgrade to Saleor 3.23.0a3 (or stable release when available), 3.22.47, 3.21.54, or 3.20.118 depending on deployment branch. These versions implement GraphQL query complexity limits and mutation batching restrictions to prevent resource exhaustion. For environments unable to upgrade immediately, implement application-layer GraphQL query depth limiting (maximum 10-15 levels), alias count restrictions (<20 per request), and mutation batch size caps (<10 operations) via reverse proxy or WAF rules. Advisory: https://github.com/saleor/saleor/security/advisories/GHSA-gqqv-xwx3-jj4h. Monitor API gateway logs for abnormal GraphQL payload sizes or repetitive field patterns indicating exploitation attempts.