Allocation of Resources Without Limits or Throttling Affecting graphql package, versions >=2.3.1, <2.3.23>=2.4.0, <2.4.18>=2.5.0, <2.5.26>=2.6.0, <2.6.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-RUBY-GRAPHQL-16425763
- published6 May 2026
- disclosed5 May 2026
- creditd0cs1s-bzhunt
Introduced: 5 May 2026
New CVE NOT AVAILABLE CWE-770 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade graphql to version 2.3.23, 2.4.18, 2.5.26, 2.6.1 or higher.
Overview
graphql is a plain-Ruby implementation of GraphQL.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper counting of comment tokens in the max_query_string_tokens configuration. An attacker can cause excessive resource consumption by submitting queries with a large number of comment tokens, bypassing the intended token limit.