Read the docs
TI-2022-06084 Aliases CVE-2022-21708GHSA-mh3m-8c74-74xh

Denial of Service in graphql-go

Priority LOW 31CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows. This in turn could potentially compromise the ability of the server to serve data to its users. The issue has been patched in version `v1.3.0`. The only known workaround for this issue is to disable the `graphql.MaxDepth` option from your schema which is not recommended.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01243 69th percentileScored 2026-11-07
Fix Partial graphql-go (graph-gophers): 1.3.0github.com/graph-gophers/graphql-go (Go): 1.3.0Red Hat: 3 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
graph-gophersgraphql-gobefore 1.3.01.3.0Patch availableCNA
—github.com/graph-gophers/graphql-go (Go)before 1.3.01.3.0Patch availableGHSA-mh3m-8c74-74xh
  • graphql-go Vendorgraph-gophers Affected before 1.3.0 Fixed in 1.3.0 Patch available CNA
  • github.com/graph-gophers/graphql-go (Go) Vendor— Affected before 1.3.0 Fixed in 1.3.0 Patch available GHSA-mh3m-8c74-74xh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:graphql-go_project:graphql-go:*:*:*:*:*:*:*:*before 1.3.0Vulnerablegraphql-go project
  • cpe:2.3:a:graphql-go_project:graphql-go:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·graphql-go project

Remediation

  • Fix · CNA graphql-go (graph-gophers) Fixed in 1.3.0
  • Fix · GHSA-mh3m-8c74-74xh github.com/graph-gophers/graphql-go (Go) Fixed in 1.3.0 Advisory →

Red Hat 3 advisories

  • RHSA-2024:4006 Released 2024-06-27 · Red Hat rating Important
    OpenShift Container Platform 4.12.60 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/ose-cluster-autoscaler-operator, openshift4/ose-console, openshift4/ose-machine-api-operator +2
  • RHSA-2024:3885 Released 2024-06-19 · Red Hat rating Important
    OpenShift Container Platform 4.13.44 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-cluster-autoscaler-operator, openshift4/ose-console, openshift4/ose-machine-api-operator
  • RHSA-2024:0735 Released 2024-02-13 · Red Hat rating Critical
    OpenShift Container Platform 4.14.12 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-console, openshift4/ose-olm-rukpak-rhel8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Security 3AffectedNo fix yet
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2024:4006
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2024:3885
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2024:0735
Not affected: 3 products
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-21708
  2. 2026-10-03 Alias added: GHSA-mh3m-8c74-74xh

References

Patch 1

Advisory 2

Other 2

  • TI-2022-17395 graphql-go (aka GraphQL for Go) through 0.8.0 has infinite recursion in the type definition parser. CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences