What is the CVSS score of EUVD-2026-20527?

EUVD-2026-20527 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Saleor are affected by EUVD-2026-20527?

Saleor e-commerce platform versions 2.0.0 through 3.22.x contain an unauthenticated denial-of-service vulnerability allowing attackers to crash production environments by submitting unbounded GraphQL…. A patch is available.

How to fix or mitigate EUVD-2026-20527?

Within 24 hours: identify all Saleor instances in production and document current versions. Within 7 days: apply vendor patches (3.20.118, 3.21.54, 3.22.47, or 3.23.0a3 depending on current major version). Within 30 days: validate patch deployment, test GraphQL query batching under load, and document completion in change management system.

Saleor EUVD-2026-20527

| CVE-2026-33756 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-04-08 GitHub_M

Denial Of Service Saleor

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 20, 2026 - 20:07 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:02 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.21.54,3.20.118,3.23.0a3

EUVD ID Assigned

Apr 08, 2026 - 18:16 euvd

EUVD-2026-20527

Analysis Generated

Apr 08, 2026 - 18:16 vuln.today

CVE Published

Apr 08, 2026 - 17:07 nvd

HIGH 7.5

DescriptionGitHub Advisory

Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL operations in a single HTTP request as a JSON array but wasn't enforcing any upper limit on the number of operations. This allowed an unauthenticated attacker to send a single HTTP request many operations (bypassing the per query complexity limit) to exhaust resources. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

AnalysisAI

Denial of service affects Saleor e-commerce platform versions 2.0.0 through 3.22.x via unlimited GraphQL query batching. Unauthenticated remote attackers can submit a single HTTP request containing an unbounded array of GraphQL operations, bypassing per-query complexity controls to exhaust server resources and render the platform unavailable. Vendor-released patches are available across all affected major versions (3.20.118, 3.21.54, 3.22.47, 3.23.0a3). No public exploit identified at time of analysis, though the attack vector is straightforward (CVSS AV:N/AC:L/PR:N).

Technical ContextAI

Saleor implements GraphQL query batching, a common optimization allowing clients to submit multiple operations in a single HTTP POST request as a JSON array. The vulnerability stems from CWE-770 (Allocation of Resources Without Limits or Throttling) - specifically, the absence of an upper bound on array size. While individual GraphQL queries had complexity limits to prevent resource exhaustion, the batching mechanism allowed attackers to submit thousands of operations in one request, multiplying resource consumption beyond intended safeguards. This affects the GraphQL execution engine's request parsing and operation scheduling logic. The affected product (cpe:2.3:a:saleor:saleor) is a Python-based headless e-commerce framework commonly deployed in high-traffic retail environments where availability is business-critical.

RemediationAI

Upgrade to patched Saleor versions immediately: 3.20.118 for the 3.20.x branch, 3.21.54 for 3.21.x, 3.22.47 for 3.22.x, or 3.23.0a3 for the 3.23 alpha series. Vendor advisory at https://github.com/saleor/saleor/security/advisories/GHSA-24jw-f244-qfpp contains migration guidance. Patches implement configurable limits on the number of GraphQL operations per request (commits e42aa4d6e588982e, cdb66da97abb7c86, d6a94e95bd77f3f733, f0371bdd4cafcc841, 7be352fa8c35875d). As an interim workaround before patching, deploy reverse proxy or WAF rules to limit HTTP POST body size to GraphQL endpoints (typically /graphql/) to a reasonable threshold (e.g., 1MB), or implement upstream rate limiting per source IP to constrain request frequency. Ensure application-level monitoring alerts on abnormal GraphQL request patterns (large payload sizes, high operation counts).