CVE-2026-33756CWE-770

Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching

High · published April 8, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
55.8
In the wild
Unconfirmed
What it is

Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL operations in a single HTTP request as a JSON array but wasn't enforcing any upper limit on the number of operations. This allowed an unauthenticated attacker to send a single HTTP request many operations (bypassing the per query complexity limit) to exhaust resources. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00791 · 55.8th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-04-08T17:07Z
EPSS history
Timeline
  • 08 APR 17:07Z
    Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching
    cvelistv5