Infinite Recursion Vulnerability in GraphQL for Go by GraphQL-Go
CVE-2022-37315

7.5HIGH

Key Information:

Vendor

Graphql-go Project

Status
Graphql-go
Vendor
CVE Published:
1 August 2022

What is CVE-2022-37315?

GraphQL for Go, an implementation of GraphQL for the Go programming language, is prone to a significant vulnerability due to infinite recursion in the type definition parser. This flaw can lead to excessive resource consumption, potentially causing denial of service conditions. Developers using affected versions up to 0.8.0 should review the issue documented in the GitHub repository to understand the implications and remediation steps.

References

https://github.com/graphql-go/graphql/issues/637
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.