CVE-2023-26144

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not proven that this vulnerability can crash the process.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/graphql/graphql-js/commit/f94b511386c7e47bd0380dcd56553dc063320226	Patch
https://github.com/graphql/graphql-js/issues/3955	Exploit Issue Tracking Third Party Advisory
https://github.com/graphql/graphql-js/pull/3972	Product
https://github.com/graphql/graphql-js/releases/tag/v16.8.1	Release Notes
https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181	Exploit Issue Tracking Patch Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:graphql:graphql::::::node.js::*
	cpe:2.3:a:graphql:graphql:17.0.0:alpha1::::node.js::*
	cpe:2.3:a:graphql:graphql:17.0.0:alpha2::::node.js::*

History

No history.

Information

Published : 2023-09-20 05:15

Updated : 2023-11-07 04:09

NVD link : CVE-2023-26144

Mitre link : CVE-2023-26144

CVE.ORG link : CVE-2023-26144

JSON object : View

Products Affected

graphql

graphql

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2023-26144", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-09-20T05:15:39.923", "references": [{"url": "https://github.com/graphql/graphql-js/commit/f94b511386c7e47bd0380dcd56553dc063320226", "tags": ["Patch"], "source": "report@snyk.io"}, {"url": "https://github.com/graphql/graphql-js/issues/3955", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://github.com/graphql/graphql-js/pull/3972", "tags": ["Product"], "source": "report@snyk.io"}, {"url": "https://github.com/graphql/graphql-js/releases/tag/v16.8.1", "tags": ["Release Notes"], "source": "report@snyk.io"}, {"url": "https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "source": "report@snyk.io"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Secondary", "source": "report@snyk.io", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance.\r\r**Note:** It was not proven that this vulnerability can crash the process."}, {"lang": "es", "value": "Las versiones del paquete graphql desde 16.3.0 y anteriores a 16.8.1 son vulnerables a la Denegaci\u00f3n de Servicio (DoS) debido a comprobaciones insuficientes en el archivo OverlappingFieldsCanBeMergedRule.ts al analizar consultas grandes. Esta vulnerabilidad permite a un atacante degradar el rendimiento del sistema. **Nota:** No se ha demostrado que esta vulnerabilidad pueda bloquear el proceso."}], "lastModified": "2023-11-07T04:09:27.820", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:graphql:graphql:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "F350F09D-E2EC-454B-AE86-D1685AFDD9D2", "versionEndExcluding": "16.8.1", "versionStartIncluding": "16.3.0"}, {"criteria": "cpe:2.3:a:graphql:graphql:17.0.0:alpha1:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "37819AB7-A406-4FC1-BB34-C949848AF13E"}, {"criteria": "cpe:2.3:a:graphql:graphql:17.0.0:alpha2:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "17EC77C2-6B00-4742-A98E-08874B982117"}], "operator": "OR"}]}], "sourceIdentifier": "report@snyk.io"}