GraphQL Java does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-40094 · ADVISORY
• graphql-java/graphql-java#3539 · WEB
• graphql-java/graphql-java commit 16c1591 · WEB
• graphql-java/graphql-java commit 469caf6 · WEB
• graphql-java/graphql-java commit 97743bc · WEB
• graphql-java/graphql-java commit fc6f304 · WEB
• graphql-java/graphql-java · WEB
• graphql-java/graphql-java release v19.11 · WEB
• graphql-java/graphql-java release v20.9 · WEB
• graphql-java/graphql-java release v21.5 · WEB

com.graphql-java:graphql-java のその他の脆弱性

• CVE-2023-28867高 7.5In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versio…
• CVE-2022-37734高 7.5graphql-java before19.0 is vulnerable to Denial of Service. An attacker can send a malicious GraphQL query that consumes CPU resources. The …