GraphQL Java does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-40094 · ADVISORY
• graphql-java/graphql-java#3539 · WEB
• graphql-java/graphql-java commit 16c1591 · WEB
• graphql-java/graphql-java commit 469caf6 · WEB
• graphql-java/graphql-java commit 97743bc · WEB
• graphql-java/graphql-java commit fc6f304 · WEB
• graphql-java/graphql-java · WEB
• graphql-java/graphql-java release v19.11 · WEB
• graphql-java/graphql-java release v20.9 · WEB
• graphql-java/graphql-java release v21.5 · WEB

Autres vulnérabilités de com.graphql-java:graphql-java

• CVE-2023-28867ÉLEVÉE 7.5In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versio…
• CVE-2022-37734ÉLEVÉE 7.5graphql-java before19.0 is vulnerable to Denial of Service. An attacker can send a malicious GraphQL query that consumes CPU resources. The …