CVE-2021-47713

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-47713

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-47713.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-47713

Published

2025-12-22T22:15:58.720Z

Modified

2026-07-09T02:48:59.483054Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

[none]

Details

Hasura GraphQL 1.3.3 contains a denial of service vulnerability that allows attackers to overwhelm the service by crafting malicious GraphQL queries with excessive nested fields. Attackers can send repeated requests with extremely long query strings and multiple threads to consume server resources and potentially crash the GraphQL endpoint.

References

Affected packages

Git / github.com/hasura/graphql-engine

Affected ranges

Type

GIT

Repo

https://github.com/hasura/graphql-engine

Events

Introduced

8c9ffbeb6d60226970f69b6ef5b08d9551d944e2

Last affected

8c9ffbeb6d60226970f69b6ef5b08d9551d944e2

Database specific

{
    "cpe": "cpe:2.3:a:hasura:graphql_engine:1.3.3:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "1.3.3"
        },
        {
            "last_affected": "1.3.3"
        }
    ]
}

Affected versions

1.*

1.3.3

v1.*

v1.3.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-47713.json"