GHSA-2hmf-46v7-v6fx

gqlparser denial of service vulnerability via the parserDirectives function

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-49559

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/vektah/gqlparser/v2	< 2.5.14	2.5.14
Go	github.com/vektah/gqlparser	< 2.5.14	2.5.14

Details

As written in the advisory (Markdown source, shown as plain text).

An issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the parserDirectives function.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-49559 advisory
https://github.com/99designs/gqlgen/issues/3118 web
https://github.com/vektah/gqlparser/commit/36a3658873bf5a107f42488dfc392949cdd02977 web
https://gist.github.com/uvzz/d3ed9d4532be16ec1040a2cf3dfec8d1 web
https://github.com/advisories/GHSA-2hmf-46v7-v6fx advisory
https://github.com/vektah/gqlparser package
https://github.com/vektah/gqlparser/blob/master/parser/query.go#L316 web