Stack-based Buffer Overflow Affecting com.graphql-java:graphql-java package, versions [,0.0.0-2023-03-20T01-49-44-80e3135)[1.2,17.5)[18.0,18.4)[19.0,19.4)[20.0,20.1)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.16% (54th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-JAVA-COMGRAPHQLJAVA-5291199
  • published27 Mar 2023
  • disclosed27 Mar 2023
  • creditUnknown

Introduced: 27 Mar 2023

CVE-2023-28867  (opens in a new tab)
CWE-121  (opens in a new tab)

How to fix?

Upgrade com.graphql-java:graphql-java to version 0.0.0-2023-03-20T01-49-44-80e3135, 17.5, 18.4, 19.4, 20.1 or higher.

Overview

Affected versions of this package are vulnerable to Stack-based Buffer Overflow when processing a deeply recursive GraphQL query. An attacker can send such a query to exhaust stack memory and cause a crash.

CVSS Scores

version 3.1