CVE-2026-80051

MediumCVSS 5.9/10Last modified Sep 9, 2026

Description

github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions (scalars.go) accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising the request error that the GraphQL specification mandates. In some cases (but not any typical case of JSON sent to a website), a deeply nested value leads to an unrecoverable "fatal error: stack overflow" condition.

Metrics

CVSS 4.0 5.9/10CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-1287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 25, 2026
Last modified
Sep 9, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-800545.5Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Incorrect PermissCVE-2026-800554.4Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliCVE-2026-800565.5Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of SensCVE-2026-800575.5Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedCVE-2026-800585.5Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Cleartext Storage CVE-2026-80065.4Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a maCVE-2026-80077.5Insufficient validation of untrusted input in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised theCVE-2026-800717.2The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate thCVE-2026-800724.7The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirectCVE-2026-800736.5Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.CVE-2026-800748.8Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-800757.8Heap-based buffer overflow in Windows Work Folders allows an authorized attacker to elevate privileges locally.