GHSA-5gc2-7c65-8fq8
async-graphql Directive Overload
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| crates.io | async-graphql | < 7.0.10 | 7.0.10 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
- Service Disruption: The server may become unresponsive or extremely slow, potentially leading to downtime.
- Resource Exhaustion: Excessive use of server resources, such as CPU and memory, could negatively impact other services running on the same infrastructure.
- User Experience Degradation: Users may experience delays or failures when accessing the service, which could lead to frustration and loss of trust in the service.
### Patches
1. Upgrade to v7.0.10
2. Use [SchemaBuilder.limit_directives](https://docs.rs/async-graphql/latest/async_graphql/struct.SchemaBuilder.html#method.limit_directives) to limit the maximum number of directives for a single field.
References
External links from the advisory. They lead to third-party sites.