github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a…
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions (scalars.go) accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising the request error that the GraphQL specification mandates. In some cases (but not any typical case of JSON sent to a website), a deeply nested value leads to an unrecoverable "fatal error: stack overflow" condition.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| graphql-go project | graphql-go | up to 0.8.1 | — | No fix listed | CNA |
- graphql-go Vendorgraphql-go project Affected up to 0.8.1 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-80051
- 2026-10-03 Alias added: GHSA-w74q-3pp2-465h
References
More graphql-go project vulnerabilities
- TI-2022-17395 graphql-go (aka GraphQL for Go) through 0.8.0 has infinite recursion in the type definition parser. CVSS 3.1HIGH 7.5
- TI-2022-06084 Denial of Service in graphql-go CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-80051 · CVE Program
- CVE-2026-80051 · NVD
- FIRST EPSS
- GHSA-w74q-3pp2-465h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences