-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing token limits in directive parsing. The original ParseQuery function set maxTokenLimit=0 (unlimited), making it the entry point for attacks. The parseDirectives function (line 316 in query.go) processes directives recursively without resource constraints when called through this unlimited parser. The fix introduced ParseQueryWithTokenLimit to enforce limits, confirming the original ParseQuery was vulnerable. Both functions work together to enable the DoS by allowing unbounded token processing.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/vektah/gqlparser/v2 | go | < 2.5.14 | 2.5.14 |
| github.com/vektah/gqlparser | go | < 2.5.14 | 2.5.14 |
Ongoing coverage of React2Shell