GHSA-2hmf-46v7-v6fx
Suggest an improvement- Source
- https://github.com/advisories/GHSA-2hmf-46v7-v6fx
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-2hmf-46v7-v6fx/GHSA-2hmf-46v7-v6fx.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-2hmf-46v7-v6fx
- Aliases
-
- CVE-2023-49559
- GO-2024-2920
- Related
- Published
- 2024-06-12T21:31:19Z
- Modified
- 2024-12-03T21:36:54Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- gqlparser denial of service vulnerability via the parserDirectives function
- Details
-
An issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the parserDirectives function.
- Database specific
{ "nvd_published_at": "2024-06-12T20:15:10Z", "cwe_ids": [ "CWE-400", "CWE-770" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-06-12T22:53:35Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2023-49559
- https://github.com/99designs/gqlgen/issues/3118
- https://github.com/vektah/gqlparser/commit/36a3658873bf5a107f42488dfc392949cdd02977
- https://gist.github.com/uvzz/d3ed9d4532be16ec1040a2cf3dfec8d1
- https://github.com/advisories/GHSA-2hmf-46v7-v6fx
- https://github.com/vektah/gqlparser
- https://github.com/vektah/gqlparser/blob/master/parser/query.go#L316
Affected packages
Go / github.com/vektah/gqlparser/v2
Package
- Name
- github.com/vektah/gqlparser/v2
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/vektah/gqlparser/v2
Go / github.com/vektah/gqlparser
Package
- Name
- github.com/vektah/gqlparser
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/vektah/gqlparser