CVE-2023-26144 - OpenCVE

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not proven that this vulnerability can crash the process.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Graphql	Graphql

Configuration 1 [-]

OR	cpe:2.3:a:graphql:graphql::::::node.js::*
	cpe:2.3:a:graphql:graphql:17.0.0:alpha1::::node.js::*
	cpe:2.3:a:graphql:graphql:17.0.0:alpha2::::node.js::*

References

Link	Resource
https://github.com/graphql/graphql-js/commit/f94b511386c7e47bd0380dcd56553dc063320226	Patch
https://github.com/graphql/graphql-js/issues/3955	Exploit Issue Tracking Third Party Advisory
https://github.com/graphql/graphql-js/pull/3972	Product
https://github.com/graphql/graphql-js/releases/tag/v16.8.1	Release Notes
https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181	Exploit Issue Tracking Patch Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: snyk

Published: 2023-09-20T05:00:02.129Z

Updated: 2023-09-20T05:00:02.129Z

Reserved: 2023-02-20T10:28:48.928Z

Link: CVE-2023-26144

JSON object: View

NVD Information

Status : Modified

Published: 2023-09-20T05:15:39.923

Modified: 2023-11-07T04:09:27.820

Link: CVE-2023-26144

JSON object: View

Redhat Information

No data.

CWE

CWE-400

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:graphql:graphql:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "F350F09D-E2EC-454B-AE86-D1685AFDD9D2", "versionEndExcluding": "16.8.1", "versionStartIncluding": "16.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:graphql:graphql:17.0.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "37819AB7-A406-4FC1-BB34-C949848AF13E", "vulnerable": true}, {"criteria": "cpe:2.3:a:graphql:graphql:17.0.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "17EC77C2-6B00-4742-A98E-08874B982117", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance.\r\r**Note:** It was not proven that this vulnerability can crash the process."}, {"lang": "es", "value": "Las versiones del paquete graphql desde 16.3.0 y anteriores a 16.8.1 son vulnerables a la Denegaci\u00f3n de Servicio (DoS) debido a comprobaciones insuficientes en el archivo OverlappingFieldsCanBeMergedRule.ts al analizar consultas grandes. Esta vulnerabilidad permite a un atacante degradar el rendimiento del sistema. **Nota:** No se ha demostrado que esta vulnerabilidad pueda bloquear el proceso."}], "id": "CVE-2023-26144", "lastModified": "2023-11-07T04:09:27.820", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "report@snyk.io", "type": "Secondary"}]}, "published": "2023-09-20T05:15:39.923", "references": [{"source": "report@snyk.io", "tags": ["Patch"], "url": "https://github.com/graphql/graphql-js/commit/f94b511386c7e47bd0380dcd56553dc063320226"}, {"source": "report@snyk.io", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/graphql/graphql-js/issues/3955"}, {"source": "report@snyk.io", "tags": ["Product"], "url": "https://github.com/graphql/graphql-js/pull/3972"}, {"source": "report@snyk.io", "tags": ["Release Notes"], "url": "https://github.com/graphql/graphql-js/releases/tag/v16.8.1"}, {"source": "report@snyk.io", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-400"}], "source": "report@snyk.io", "type": "Secondary"}]}