Graphql Go
Monthly
Stack overflow denial of service in github.com/graphql-go/graphql (through v0.8.1) crashes any Go server process embedding the library when an attacker submits a specifically crafted GraphQL request containing a deeply nested scalar value of a mismatched type. The `coerceString` and `coerceBool` functions in `scalars.go` violate the GraphQL specification by accepting type-mismatched scalar input instead of returning a request error, and under specific deep-nesting conditions exhaust Go's call stack and trigger an unrecoverable fatal error that immediately terminates the host process. A publicly available proof-of-concept exists via the Openwall security list; however, no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 vector (AV:L, AT:P) combined with the description's explicit caveat that this is not triggered by typical web JSON traffic indicates exploitation requires a non-standard input path.
graphql-go (aka GraphQL for Go) through 0.8.0 has infinite recursion in the type definition parser. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stack overflow denial of service in github.com/graphql-go/graphql (through v0.8.1) crashes any Go server process embedding the library when an attacker submits a specifically crafted GraphQL request containing a deeply nested scalar value of a mismatched type. The `coerceString` and `coerceBool` functions in `scalars.go` violate the GraphQL specification by accepting type-mismatched scalar input instead of returning a request error, and under specific deep-nesting conditions exhaust Go's call stack and trigger an unrecoverable fatal error that immediately terminates the host process. A publicly available proof-of-concept exists via the Openwall security list; however, no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 vector (AV:L, AT:P) combined with the description's explicit caveat that this is not triggered by typical web JSON traffic indicates exploitation requires a non-standard input path.
graphql-go (aka GraphQL for Go) through 0.8.0 has infinite recursion in the type definition parser. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.