EUVD-2026-65681
GHSA-w74q-3pp2-465h
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Library is network-facing but AC:H reflects the non-trivial deeply-nested input requirement; fatal crash yields A:H; no confidentiality or integrity impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions (scalars.go) accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising the request error that the GraphQL specification mandates. In some cases (but not any typical case of JSON sent to a website), a deeply nested value leads to an unrecoverable "fatal error: stack overflow" condition.
AnalysisAI
Stack overflow denial of service in github.com/graphql-go/graphql (through v0.8.1) crashes any Go server process embedding the library when an attacker submits a specifically crafted GraphQL request containing a deeply nested scalar value of a mismatched type. The coerceString and coerceBool functions in scalars.go violate the GraphQL specification by accepting type-mismatched scalar input instead of returning a request error, and under specific deep-nesting conditions exhaust Go's call stack and trigger an unrecoverable fatal error that immediately terminates the host process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires submitting a GraphQL request in which a scalar variable (declared as String, ID, or Boolean) is assigned a deeply nested composite value rather than a flat scalar - a structure that does not arise in typical JSON-over-HTTP GraphQL traffic. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.9 (Medium) reflects a genuine but conditionally constrained denial-of-service risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to the GraphQL endpoint constructs a query containing a scalar variable declared as a String or Boolean but supplied with a deeply nested composite value. When the graphql-go library attempts to coerce the variable, the coerceString or coerceBool function recurses into the nested structure without type-checking, exhausting the Go call stack and producing a fatal error that immediately terminates the server process without any possibility of recovery. … |
| Remediation | No vendor-released patch identified at time of analysis - provided references point only to the vulnerable source code at scalars.go#L307-L315 and the Openwall exploit disclosure, with no fix commit or tagged release cited. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Graphql Go
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today