async-graphql

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

1. High, CVSS 8.7crates.ioPublished 3 Oct 2024

   async-graphql Directive Overload

   CVE-2024-47614 · GHSA-5gc2-7c65-8fq8

   Affected

   • crates.io async-graphql < 7.0.10

   Fixed in

   7.0.10· Vendor fix available

   Issue

   Impact - Service Disruption: The server may become unresponsive or extremely slow, potentially leading to downtime. - Resource Exhaustion: Excessive use of server resources, such as CPU and memory, could negatively impact other services running on the same infrastructure. - User Experience Degradation: Users may experience delays or failures when accessing the service, which could lead to frustration and loss of trust in the service. Patches 1. Upgrade to v7.0.10 2. Use SchemaBuilder.limitdirectives to limit the maximum number of directives for a single field.

   Recommended action: Upgrade to 7.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 15:38 UTCEvidence →
2. High, CVSS 7.5crates.ioPublished 29 Jul 2022

   async-graphql / async-graphql - @DOS GraphQL Nested Fragments overflow

   GHSA-xq3c-8gqm-v648

   Affected

   • crates.io async-graphql < 4.0.6

   Fixed in

   4.0.6· Vendor fix available

   Issue

   Impact Executing deeply nested queries may cause stack overflow. Patches Upgrade to v4.0.6

   Recommended action: Upgrade to 4.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 15:33 UTCEvidence →