Vulnerability · Published Jul 30, 2024 · Assigned by mitre
CVE-2024-40094
Medium 5.3
In plain English
A medium-severity security flaw in the com.graphql-java:graphql-java package (Maven). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 61% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.0%top 38.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.graphql-java:graphql-java | 19.11 | GHSA-h9mq-f6q5-6c8m |
| Maven | com.graphql-java:graphql-java | 20.9 | GHSA-h9mq-f6q5-6c8m |
| Maven | com.graphql-java:graphql-java | 21.5 | GHSA-h9mq-f6q5-6c8m |
Affected products (as reported)
References
- https://github.com/graphql-java/graphql-java/releases/tag/v21.5
- https://github.com/graphql-java/graphql-java/releases/tag/v20.9
- https://github.com/graphql-java/graphql-java/releases/tag/v19.11
- https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a
- https://github.com/graphql-java/graphql-java/discussions/3641
- https://github.com/graphql-java/graphql-java/pull/3539