CVE-2022-21708

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows. This in turn could potentially compromise the ability of the server to serve data to its users. The issue has been patched in version `v1.3.0`. The only known workaround for this issue is to disable the `graphql.MaxDepth` option from your schema which is not recommended.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400CWE-674

Affected software

No affected versions have been published.

Timeline

Published
Jan 21, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-21715.4The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to maCVE-2022-217106.1ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists iCVE-2022-217117.1elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF fileCVE-2022-217127.5twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when CVE-2022-217134.3Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do notCVE-2022-217156.1CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\CVE-2022-217167.5Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implemCVE-2022-217185.0Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior toCVE-2022-217196.1GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. CVE-2022-21724.3The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change seCVE-2022-217204.9GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally iCVE-2022-217217.5Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a