GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens
Priority LOW 38CWE-770Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-770.
Summary
GraphQL-Ruby's `max_query_string_tokens` configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached. In patched versions, the Ruby lexer does count these tokens. GraphQL-CParser is not affected by this problem. `max_query_string_tokens` was introduced in v2.3.1. Each 2.x version has received a new patch release for including a fix.
Why it matters now
Fix Fixed graphql (RubyGems): 2.6.1, 2.5.26, 2.4.18 +1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | graphql (RubyGems) | 2.6.0 to before 2.6.1 | 2.6.1 | Patch available | GHSA-3h96-34p3-xm76 |
| — | graphql (RubyGems) | 2.5.0 to before 2.5.26 | 2.5.26 | Patch available | GHSA-3h96-34p3-xm76 |
| — | graphql (RubyGems) | 2.4.0 to before 2.4.18 | 2.4.18 | Patch available | GHSA-3h96-34p3-xm76 |
| — | graphql (RubyGems) | 2.3.1 to before 2.3.23 | 2.3.23 | Patch available | GHSA-3h96-34p3-xm76 |
- graphql (RubyGems) Vendor— Affected 2.6.0 to before 2.6.1 Fixed in 2.6.1 Patch available GHSA-3h96-34p3-xm76
- graphql (RubyGems) Vendor— Affected 2.5.0 to before 2.5.26 Fixed in 2.5.26 Patch available GHSA-3h96-34p3-xm76
- graphql (RubyGems) Vendor— Affected 2.4.0 to before 2.4.18 Fixed in 2.4.18 Patch available GHSA-3h96-34p3-xm76
- graphql (RubyGems) Vendor— Affected 2.3.1 to before 2.3.23 Fixed in 2.3.23 Patch available GHSA-3h96-34p3-xm76
Remediation
- Fix · GHSA-3h96-34p3-xm76 graphql (RubyGems) Fixed in 2.6.1 Advisory →
- Fix · GHSA-3h96-34p3-xm76 graphql (RubyGems) Fixed in 2.5.26 Advisory →
- Fix · GHSA-3h96-34p3-xm76 graphql (RubyGems) Fixed in 2.4.18 Advisory →
- Fix · GHSA-3h96-34p3-xm76 graphql (RubyGems) Fixed in 2.3.23 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-3h96-34p3-xm76
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences