RUSTSEC-2026-0416

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0416

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0416.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0416

Aliases

GHSA-34cw-x8g7-rcv5

Published

2026-10-28T12:00:00Z

Modified

2026-10-29T14:15:02Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Stack overflow on deeply nested GraphQL documents

Details

The parser of juniper called itself once for each level of nesting in a GraphQL document. The parser had no limit on the nesting depth. Deeply nested selection sets, input values, and list types thus overflowed the stack of the thread that parsed the document. Validation and execution followed fragment spreads in the same recursive way. Long chains of fragment spreads thus overflowed the stack in validation and execution.

A stack overflow aborts the whole process. One request can thus stop a server and drop all other requests in progress. The request needs no authentication.

juniper 0.17.2 rejects documents that nest deeper than 64 levels or contain more than 15,000 tokens. RootNode::limit_depth() and RootNode::limit_tokens() change the limits.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / juniper

Package

Name: juniper; View open source insights on deps.dev
Purl: pkg:cargo/juniper

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.17.2

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [],
        "os":  []
    }
}