id: GO-2022-0300
modules:
    - module: github.com/graph-gophers/graphql-go
      versions:
        - fixed: 1.3.0
      vulnerable_at: 1.2.0
      packages:
        - package: github.com/graph-gophers/graphql-go
          symbols:
            - Schema.ValidateWithVariables
            - Schema.exec
            - Schema.subscribe
          derived_symbols:
            - Schema.Exec
            - Schema.Subscribe
            - Schema.ToJSON
            - Schema.Validate
summary: Panic via malicious inputs in github.com/graph-gophers/graphql-go
description: |-
    Malicious inputs can cause a panic.

    A maliciously crafted input can cause a stack overflow and panic. Any user with
    access to the GraphQL can send such a query.

    This issue only occurs when using the graphql.MaxDepth schema option (which is
    highly recommended in most cases).
published: 2022-07-15T23:10:20Z
cves:
    - CVE-2022-21708
ghsas:
    - GHSA-mh3m-8c74-74xh
references:
    - fix: https://github.com/graph-gophers/graphql-go/commit/eae31ca73eb3473c544710955d1dbebc22605bfe