CVE-2024-39895 Directus GraphQL Field Duplication Denial of Service (DoS)
An attacker can cause a denial of service in Directus by sending GraphQL queries with duplicated fields, exhausting server resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-39895?
CVE-2024-39895 is a medium-severity denial of service vulnerability in Monospace Directus, published on 8 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users. Request to the endpoint /graphql are sent when visualizing graphs generated at a dashboard. By modifying the data sent and duplicating many times the fields a DoS attack is possible. This vulnerability is fixed in 10.12.0.
Weakness: CWE-400
Which versions are affected by CVE-2024-39895?
2 open source packages ship an affected version, including @directus/env. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@directus/env npm | All versions | 1.1.6 |
@directus/env npm | All versions | 1.1.6 |
Products include Monospace Directus.
How do I fix CVE-2024-39895?
Upgrade @directus/env to 1.1.6 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-39895 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-39895 exists.
Other vulnerabilities in Monospace Directus
- CVE-2022-26969 Insecure default value for CORS configuration
- CVE-2025-55746 Directus allows unauthenticated file upload and file modification due to lacking input sanitization
- CVE-2026-35408 Directus is Missing Cross-Origin Opener Policy
- CVE-2026-61836 Directus: Authorization-dependent response served from unsegmented cache key
- CVE-2025-30353 Directus's webhook trigger flows can leak sensitive data
Sources
Also known as GHSA-7hmh-pfrp-vcx4.