| modules: |
| - module: github.com/graph-gophers/graphql-go |
| versions: |
| - fixed: 1.3.0 |
| vulnerable_at: 1.2.0 |
| packages: |
| - package: github.com/graph-gophers/graphql-go |
| symbols: |
| - Schema.ValidateWithVariables |
| - Schema.exec |
| - Schema.subscribe |
| derived_symbols: |
| - Schema.Exec |
| - Schema.Subscribe |
| - Schema.ToJSON |
| - Schema.Validate |
| description: | |
| Malicious inputs can cause a panic. |
| |
| A maliciously crafted input can cause a stack overflow and panic. |
| Any user with access to the GraphQL can send such a query. |
| |
| This issue only occurs when using the graphql.MaxDepth schema option |
| (which is highly recommended in most cases). |
| published: 2022-07-15T23:10:20Z |
| cves: |
| - CVE-2022-21708 |
| ghsas: |
| - GHSA-mh3m-8c74-74xh |
| references: |
| - fix: https://github.com/graph-gophers/graphql-go/commit/eae31ca73eb3473c544710955d1dbebc22605bfe |
