CVE-2026-33756 Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching

What is CVE-2026-33756?

CVE-2026-33756 is a high-severity denial of service vulnerability in saleor, published on 8 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL operations in a single HTTP request as a JSON array but wasn't enforcing any upper limit on the number of operations. This allowed an unauthenticated attacker to send a single HTTP request many operations (bypassing the per query complexity limit) to exhaust resources. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

Weakness: CWE-770

Which versions are affected by CVE-2026-33756?

It affects 1 product.

Products include Saleor Saleor.

How do I fix CVE-2026-33756?

No fix has been published for CVE-2026-33756 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-33756 being exploited?

There is no known exploitation of CVE-2026-33756 in the wild and no public exploit code.

Other vulnerabilities in saleor

• CVE-2026-24136 Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API High 8.7
• CVE-2026-23499 Saleor vulnerable to stored XSS via Unrestricted File Upload High 8.5
• CVE-2026-35401 Saleor has a resource exhaustion vulnerability in GraphQL queries High 7.5
• CVE-2026-22849 Saleor lacks proper HTML sanitization in rich text fields High 7.2
• CVE-2023-26051 Saleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptions Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-24jw-f244-qfpp.