org.springframework.graphql:spring-graphql 1.4.6

Direct Vulnerabilities

Known vulnerabilities in the org.springframework.graphql:spring-graphql package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `WebSocketGraphQlClient` when the keepAlive option is enabled and an attacker is able to interfere with the WebSocket connection. An attacker can exhaust application memory by controlling the GraphQL server or performing a Man-in-the-Middle attack on the WebSocket connection. Note: This is only exploitable if the application uses the `WebSocketGraphQlClient` with keepAlive enabled and the attacker can interfere with the WebSocket connection. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.springframework.graphql:spring-graphql` to version 2.0.5 or higher.	[1.3.0,2.0.5)
H Allocation of Resources Without Limits or Throttling org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the pagination support. An attacker can exhaust application memory or place significant, prolonged load on the underlying datastore by forging a malicious query for a Connection field that is backed by a Spring Data repository and exposed through auto-registration support. Note: This is only exploitable if the application exposes a Connection-typed Query field backed by a Spring Data repository through auto-registration support (such as `QueryByExampleDataFetcher` or `QuerydslDataFetcher`) and does not enforce additional query complexity checks. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.springframework.graphql:spring-graphql` to version 2.0.5 or higher.	[1.2.0,2.0.5)
H Cross-site Request Forgery (CSRF) org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the `GraphiQL` process. An attacker can access confidential information by enticing a victim with an active session to follow a malicious link to the `GraphiQL` page, causing the victim's browser to send sensitive data to the attacker's website. Note: This is only exploitable if the `GraphiQL` endpoint is enabled and exposed, and a victim with an active session visits a malicious link. How to fix Cross-site Request Forgery (CSRF)? Upgrade `org.springframework.graphql:spring-graphql` to version 2.0.5 or higher.	[1.0.0,2.0.5)
C Unsafe Dependency Resolution org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the `GraphiQL`. An attacker can execute arbitrary JavaScript code in the context of users' browsers by compromising the CDN or the network path to it, allowing access to non-HttpOnly cookies and the ability to issue authenticated same-origin requests, including GraphQL operations. Note: This is only exploitable if the `GraphiQL` endpoint is enabled and exposed, and the CDN or its network path is compromised. How to fix Unsafe Dependency Resolution? Upgrade `org.springframework.graphql:spring-graphql` to version 2.0.5 or higher.	[1.0.0,2.0.5)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WebSocketGraphQlClient when the keepAlive option is enabled and an attacker is able to interfere with the WebSocket connection. An attacker can exhaust application memory by controlling the GraphQL server or performing a Man-in-the-Middle attack on the WebSocket connection.

Note: This is only exploitable if the application uses the WebSocketGraphQlClient with keepAlive enabled and the attacker can interfere with the WebSocket connection.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.springframework.graphql:spring-graphql to version 2.0.5 or higher.

[1.3.0,2.0.5)

Allocation of Resources Without Limits or Throttling

org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the pagination support. An attacker can exhaust application memory or place significant, prolonged load on the underlying datastore by forging a malicious query for a Connection field that is backed by a Spring Data repository and exposed through auto-registration support.

Note: This is only exploitable if the application exposes a Connection-typed Query field backed by a Spring Data repository through auto-registration support (such as QueryByExampleDataFetcher or QuerydslDataFetcher) and does not enforce additional query complexity checks.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.springframework.graphql:spring-graphql to version 2.0.5 or higher.

[1.2.0,2.0.5)

Cross-site Request Forgery (CSRF)

org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the GraphiQL process. An attacker can access confidential information by enticing a victim with an active session to follow a malicious link to the GraphiQL page, causing the victim's browser to send sensitive data to the attacker's website.

Note: This is only exploitable if the GraphiQL endpoint is enabled and exposed, and a victim with an active session visits a malicious link.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade org.springframework.graphql:spring-graphql to version 2.0.5 or higher.

[1.0.0,2.0.5)

Unsafe Dependency Resolution

org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications

Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the GraphiQL. An attacker can execute arbitrary JavaScript code in the context of users' browsers by compromising the CDN or the network path to it, allowing access to non-HttpOnly cookies and the ability to issue authenticated same-origin requests, including GraphQL operations.

Note: This is only exploitable if the GraphiQL endpoint is enabled and exposed, and the CDN or its network path is compromised.

How to fix Unsafe Dependency Resolution?

Upgrade org.springframework.graphql:spring-graphql to version 2.0.5 or higher.

[1.0.0,2.0.5)

org.springframework.graphql:spring-graphql@1.4.6

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically