Excessive CPU and memory use on crafted GraphQL documents

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Several parts of `juniper` did work that grew faster than the size of the GraphQL document. A small document could thus use seconds of CPU time or gigabytes of memory. The requests need no authentication. - `OverlappingFieldsCanBeMerged` compared all pairs of fields with the same response name. The rule also reported one error for each pair of conflicting fields. - `NoFragmentCycles` and `OverlappingFieldsCanBeMerged` visited a fragment again for each path that spread the fragment. Validation time thus doubled with each fragment that spread the next fragment twice. - Execution resolved the fields of a fragment once for each spread of the fragment. A document of 1.2 KB could expand into a billion fields. - The parser removed each token from the front of a vector. Parsing time thus grew with the square of the number of tokens. `juniper` 0.17.2 fixes the issues. The parser rejects documents with more than 15,000 tokens and operations with more than 15,000 fields after the expansion of…

Published by the source

28 Oct 2026, 12:00 UTC

Last modified by the source

29 Oct 2026, 14:15 UTC

Source last checked

30 Oct 2026, 07:10 UTC

1. Revision 1 · created · 30 Oct 2026

   Published from osv record RUSTSEC-2026-0417

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-36rq-8957-mjrx

Advisory: Excessive CPU and memory use on crafted GraphQL documents
IDs: GHSA-36rq-8957-mjrx
Record: https://patchnext.com/advisories/rustsec-2026-0417 (revision 1, source checked 30 Oct 2026, 07:10 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: juniper 0.17.2. A vendor fix does not mean a deployment is fixed.

## Affected components
- crates.io juniper: affected >= 0.0.0-0, < 0.17.2; fixed in 0.17.2

## Suggested inspection (read-only)
- crates.io juniper: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on juniper.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/RUSTSEC-2026-0417 (OSV record RUSTSEC-2026-0417 lists affected ranges: crates.io juniper >=0.0.0-0 <0.17.2 (fixed))

Commands are suggestions: review each one before running it.