Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.
Recommended action: Upgrade to 21.5, 20.9 or 19.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
17.519.418.40.0.0-2023-03-20T01-49-44-80e313520.1· Vendor fix available
Issue
In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.
Recommended action: Upgrade to 20.1, 19.4, 18.4 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
graphql-java before 19.0, 18.3, and 17.4 is vulnerable to Denial of Service. An attacker send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0, 18.3, and 17.4.
Recommended action: Upgrade to 18.3 or 17.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.