Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/graph-gophers/graphql-go

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5GoPublished

    Denial of Service in graphql-go

    CVE-2022-21708 · GHSA-mh3m-8c74-74xh

    Affected
    • Go github.com/graph-gophers/graphql-go < 1.3.0
    Fixed in
    1.3.0· Vendor fix available
    Issue
    Impact This is a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows. This in turn could potentially compromise the ability of the server to serve data to its users. To make things worse the only mitigation in affected versions creates opportunities for other attacks. This issue is only available if you are using graphql.MaxDepth option in your schema (which is highly recommended in most cases). Patches The issue has been patched in version v1.3.0. We have been trying to maintain backwards compatibility and avoid breaking changes so upgrading should not be problematic. Workarounds The best workaround is to patch to a version greater than or equal to v1.3.0. Otherwise, the only workaround in versions prior to v1.3.0 is to disable the graphql.MaxDepth option from your schema.…

    Recommended action: Upgrade to 1.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →