CVE-2023-26144CWE-400

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the…

Medium · published September 20, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
73.3
In the wild
Unconfirmed
What it is

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not proven that this vulnerability can crash the process.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
CVSS v4.0
Not supplied
EPSS
0.01454 · 73.3th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2023-09-20T05:00Z
EPSS history
Timeline
  • 20 SEP 05:00Z
    Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the…
    cvelistv5