Uncontrolled resource consumption in graphql
Priority MEDIUM 63CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 2 fixed, 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not proven that this vulnerability can crash the process.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01454 73rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial graphql: 16.8.1graphql (npm): 16.8.1Red Hat: 1 advisoryRed Hat: 2 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | graphql | 16.3.0 to before 16.8.1 | 16.8.1 | Patch available | CNA |
| — | graphql (npm) | 16.3.0 to before 16.8.1 | 16.8.1 | Patch available | GHSA-9pv7-vfvm-6vr7 |
- graphql Vendor— Affected 16.3.0 to before 16.8.1 Fixed in 16.8.1 Patch available CNA
- graphql (npm) Vendor— Affected 16.3.0 to before 16.8.1 Fixed in 16.8.1 Patch available GHSA-9pv7-vfvm-6vr7
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:graphql:graphql:*:*:*:*:*:node.js:*:* | 16.3.0 to before 16.8.1 | Vulnerable | graphql |
| cpe:2.3:a:graphql:graphql:17.0.0:alpha1:*:*:*:node.js:*:* | 17.0.0 alpha1 | Vulnerable | graphql |
| cpe:2.3:a:graphql:graphql:17.0.0:alpha2:*:*:*:node.js:*:* | 17.0.0 alpha2 | Vulnerable | graphql |
- cpe:2.3:a:graphql:graphql:*:*:*:*:*:node.js:*:* Versions 16.3.0 to before 16.8.1 Vulnerable ·graphql
- cpe:2.3:a:graphql:graphql:17.0.0:alpha1:*:*:*:node.js:*:* Versions 17.0.0 alpha1 Vulnerable ·graphql
- cpe:2.3:a:graphql:graphql:17.0.0:alpha2:*:*:*:node.js:*:* Versions 17.0.0 alpha2 Vulnerable ·graphql
Remediation
- Fix · CNA graphql Fixed in 16.8.1
- Fix · GHSA-9pv7-vfvm-6vr7 graphql (npm) Fixed in 16.8.1 Advisory →
Red Hat 1 advisory
- RHSA-2024:1570 Released 2024-03-28 · Red Hat rating ImportantACS 4.4 enhancement and security update
- RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Will not fix |
| 8Base-MTV-2.5 | Fixed | — |
| RHACS 4.4 for RHEL 8 | Fixed | RHSA-2024:1570 |
Not affected: 3 products
- 8Base-MTV-2.5
- RHACS 4.4 for RHEL 8
- Red Hat Advanced Cluster Management for Kubernetes 2
Timeline
- 2026-10-02 Threatist record created from CVE-2023-26144
- 2026-10-03 Alias added: GHSA-9pv7-vfvm-6vr7
References
Sources
- CVE-2023-26144 · CVE Program
- CVE-2023-26144 · NVD
- FIRST EPSS
- GHSA-9pv7-vfvm-6vr7 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-26144 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences