graphql-go EUVD-2026-65681

Exploitation requires submitting a GraphQL request in which a scalar variable (declared as String, ID, or Boolean) is assigned a deeply nested composite value rather than a flat scalar - a structure that does not arise in typical JSON-over-HTTP GraphQL traffic. The description explicitly states the crash does not occur in 'any typical case of JSON sent to a website,' and the CVSS 4.0 AT:P (Attack Requirements: Present) confirms a specific non-standard input structure must be deliberately constructed. No authentication is required per PR:N in the CVSS vector, but the attacker must be able to send controlled GraphQL input to the target endpoint. Exploitation is not achievable by standard GraphQL clients or typical API consumers; it requires an attacker who understands the specific nesting condition and intentionally crafts the malicious payload. The limiting factors are: (1) the non-standard input format required, (2) network access to a GraphQL endpoint served by the vulnerable library, and (3) any depth-limiting or input-validation middleware deployed in front of the library would prevent triggering the condition.

The CVSS 4.0 score of 5.9 (Medium) reflects a genuine but conditionally constrained denial-of-service risk. The availability impact is correctly rated High (VA:H) because a successful trigger produces an immediate, unrecoverable Go process crash with no defensive recovery path. Several signals limit practical exploitability: the AV:L (Local) attack vector in the provided CVSS 4.0 vector and the description's explicit qualifier that the crash does not occur in 'any typical case of JSON sent to a website' together indicate that standard HTTP GraphQL clients cannot trivially trigger the condition. The AT:P (Attack Requirements: Present) metric confirms a specific non-default input structure must be constructed. A proof-of-concept is publicly documented on the Openwall security mailing list, confirming the flaw is reproducible and understood, which elevates urgency beyond a theoretical finding. However, no CISA KEV listing exists, so confirmed active exploitation is absent. EPSS data was not provided in the input; the medium CVSS score alone should not drive deprioritization given the zero-recovery nature of Go fatal errors. The absence of a confirmed fix version in any provided reference is a notable operational gap - operators cannot verify remediation without independently monitoring the upstream repository.

An attacker with access to the GraphQL endpoint constructs a query containing a scalar variable declared as a String or Boolean but supplied with a deeply nested composite value. When the graphql-go library attempts to coerce the variable, the coerceString or coerceBool function recurses into the nested structure without type-checking, exhausting the Go call stack and producing a fatal error that immediately terminates the server process without any possibility of recovery. A proof-of-concept demonstrating this technique is publicly available via the Openwall security mailing list.