CVE-2023-28867 GraphQL Java vulnerable to stack consumption
An attacker can cause a denial of service in applications using GraphQL Java by sending a crafted query that exhausts stack resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-28867?
CVE-2023-28867 is a high-severity denial of service vulnerability in n/a, published on 27 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.
Weakness: CWE-770
Which versions are affected by CVE-2023-28867?
10 open source packages ship an affected version, including com.graphql-java:graphql-java. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.graphql-java:graphql-java Maven | All versions | 0.0.0-2023-03-20T01-49-44-80e3135 |
com.graphql-java:graphql-java Maven | All versions | 0.0.0-2023-03-20T01-49-44-80e3135 |
com.graphql-java:graphql-java Maven | From 1.2 | 17.5 |
com.graphql-java:graphql-java Maven | From 1.2 | 17.5 |
com.graphql-java:graphql-java Maven | From 18.0 | 18.4 |
com.graphql-java:graphql-java Maven | From 18.0 | 18.4 |
4 more packages
com.graphql-java:graphql-java Maven | From 19.0 | 19.4 |
com.graphql-java:graphql-java Maven | From 19.0 | 19.4 |
com.graphql-java:graphql-java Maven | From 20.0 | 20.1 |
com.graphql-java:graphql-java Maven | From 20.0 | 20.1 |
Products include Graphql-Java Graphql-Java.
How do I fix CVE-2023-28867?
Upgrade com.graphql-java:graphql-java to a fixed version for your release line: 0.0.0-2023-03-20T01-49-44-80e3135, 17.5, 18.4 or 19.4.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-28867 being exploited?
There is no known exploitation of CVE-2023-28867 in the wild and no public exploit code.
Sources
Also known as GHSA-p4qx-6w5p-4rj2, ROOT-APP-MAVEN-CVE-2023-28867.