GHSA-v62j-cxhh-fq22

graphql-java vulnerable to Denial of Service via GraphQL query that consumes CPU resources

Source: GitHub Advisory Database (reviewed) High CVE-2022-37734

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.graphql-java:graphql-java	< 17.4	17.4
Maven	com.graphql-java:graphql-java	>= 18.0, < 18.3	18.3

Details

As written in the advisory (Markdown source, shown as plain text).

graphql-java before 19.0, 18.3, and 17.4 is vulnerable to Denial of Service. An attacker send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0, 18.3, and 17.4.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-37734 advisory
https://github.com/graphql-java/graphql-java/issues/2888 web
https://github.com/graphql-java/graphql-java/pull/2892 web
https://github.com/graphql-java/graphql-java package
https://github.com/graphql-java/graphql-java/discussions/2958 web
https://github.com/graphql-java/graphql-java/releases web
https://security.snyk.io/vuln/SNYK-JAVA-COMGRAPHQLJAVA-3021519 web