Grackle has StackOverflowError in GraphQL query processing

CVE-2023-50730

What is CVE-2023-50730?

Grackle, a GraphQL server implemented in functional Scala, previously failed to validate GraphQL fragments for cycles in versions prior to 0.18.0. This oversight allowed queries with cyclic fragments to pass type checking and compilation. As a result, executing such queries triggered a JVM StackOverflowError, potentially leading to Denial of Service scenarios. The parsing mechanism relied on the cats-parse library's recursive operator, which is not stack safe, and therefore could allow deeply nested fragments to lead to a stack overflow. This vulnerability highlights the importance of implementing security measures, particularly in applications with untrusted users. Users are advised to upgrade to the latest version to mitigate risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References