CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2023-28867
High (7.5) in graphql-java graphql-java. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in com.graphql-java:graphql-java 0.0.0-2023-03-20T01-49-44-80e3135, 17.5, 18.4.
In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
- CWE
- CWE-770
- Published
- Modified
- Record from
- the NVD, synced
Affected
- graphql-java:graphql-java
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p4qx-6w5p-4rj2 | Maven | com.graphql-java:graphql-java | <0.0.0-2023-03-20T01-49-44-80e3135 | 0.0.0-2023-03-20T01-49-44-80e3135 |
| GHSA-p4qx-6w5p-4rj2 | Maven | com.graphql-java:graphql-java | >=1.2 <17.5 | 17.5 |
| GHSA-p4qx-6w5p-4rj2 | Maven | com.graphql-java:graphql-java | >=18.0 <18.4 | 18.4 |
| GHSA-p4qx-6w5p-4rj2 | Maven | com.graphql-java:graphql-java | >=19.0 <19.4 | 19.4 |
| GHSA-p4qx-6w5p-4rj2 | Maven | com.graphql-java:graphql-java | >=20.0 <20.1 | 20.1 |
References
- https://github.com/graphql-java/graphql-java/pull/3112
- https://github.com/graphql-java/graphql-java/releases/tag/v17.5
- https://github.com/graphql-java/graphql-java/releases/tag/v18.4
- https://github.com/graphql-java/graphql-java/releases/tag/v19.4
- https://github.com/graphql-java/graphql-java/releases/tag/v20.1