CVE-2026-80051

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-80051
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80051.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-80051
Published
2026-08-25T17:55:57.383Z
Modified
2026-08-27T11:47:50.623527209Z
Severity
  • 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
[none]
Details

github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions (scalars.go) accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising the request error that the GraphQL specification mandates. In some cases (but not any typical case of JSON sent to a website), a deeply nested value leads to an unrecoverable "fatal error: stack overflow" condition.

Database specific 
{
    "cwe_ids": [
        "CWE-1287"
    ],
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80051.json"
}
References

Affected packages

Git / github.com/graphql-go/graphql

Affected ranges

Type
GIT
Repo
https://github.com/graphql-go/graphql
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a9741863816e423e4287fd8947731d637451cf6c
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.1"
        },
        {
            "fixed": "0.8.1"
        }
    ]
}

Affected versions

v0.*
v0.4.18
v0.5.0
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.7.8
v0.7.9
v0.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80051.json"