CVE-2023-26144

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not proven that this vulnerability can crash the process.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
n/agraphql>= 16.3.0, < 16.8.1

References

Timeline

Published
Sep 20, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-261458.1This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.CVE-2023-261466.1All versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name containing a maliciCVE-2023-261476.1All versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers valueCVE-2023-261485.3All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attaCVE-2023-261496.1Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, viaCVE-2023-26155.4Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-261507.5Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space witCVE-2023-261517.5Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet anCVE-2023-261527.5All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath CVE-2023-261539.8Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_CVE-2023-261545.9Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; alCVE-2023-261559.8All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize
CVE-2023-26144: Medium severity, CVSS 5.3 | Vulnix