-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from recursive graph traversal implementations in validation rules that used stack-based recursion without depth limits. The commit diff shows replacements of recursive calls with heap-allocated stacks (Vec-based iteration), indicating the original functions were vulnerable to unbounded recursion. Key files modified include no_fragment_cycles.rs where the cycle detection was reimplemented to avoid recursion, and similar patterns in other validation rules. The POC demonstrates that ~7500 nested fragments cause crashes, matching typical stack size limitations in Rust.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| juniper | rust | < 0.15.10 | 0.15.10 |
RustRustOngoing coverage of React2Shell