CVE-2024-40094 GraphQL Java does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service
Attackers can cause denial of service in applications using GraphQL Java by sending malicious introspection queries that bypass resource limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-40094?
CVE-2024-40094 is a medium-severity denial of service vulnerability in n/a, published on 30 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.
Which versions are affected by CVE-2024-40094?
6 open source packages ship an affected version, including com.graphql-java:graphql-java.
| Package | Affected | Fixed in |
|---|---|---|
com.graphql-java:graphql-java Maven | All versions | 19.11 |
com.graphql-java:graphql-java Maven | All versions | 19.11 |
com.graphql-java:graphql-java Maven | From 20.0 | 20.9 |
com.graphql-java:graphql-java Maven | From 20.0 | 20.9 |
com.graphql-java:graphql-java Maven | From 21.0 | 21.5 |
com.graphql-java:graphql-java Maven | From 21.0 | 21.5 |
How do I fix CVE-2024-40094?
Upgrade com.graphql-java:graphql-java to a fixed version for your release line: 19.11, 20.9 or 21.5.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-40094 being exploited?
There is no known exploitation of CVE-2024-40094 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as CLEANSTART-2026-BT38651, CLEANSTART-2026-FI38634, GHSA-h9mq-f6q5-6c8m, MINI-cv2f-686c-73q7, MINI-vghx-vx7j-xj7x, ROOT-APP-MAVEN-CVE-2024-40094.