| id: GO-2024-2920 |
| modules: |
| - module: github.com/vektah/gqlparser |
| vulnerable_at: 1.3.1 |
| packages: |
| - package: github.com/vektah/gqlparser/parser |
| symbols: |
| - parser.parseDirectives |
| derived_symbols: |
| - ParseQuery |
| - ParseSchema |
| - ParseSchemas |
| - module: github.com/vektah/gqlparser/v2 |
| versions: |
| - fixed: 2.5.14 |
| vulnerable_at: 2.5.13 |
| packages: |
| - package: github.com/vektah/gqlparser/v2/parser |
| symbols: |
| - parser.parseDirectives |
| derived_symbols: |
| - ParseQuery |
| - ParseSchema |
| - ParseSchemas |
| summary: Denial of service vulnerability via the parseDirectives function in github.com/vektah/gqlparser |
| description: |- |
| An issue in vektah gqlparser open-source-library allows a remote |
| attacker to cause a denial of service via a crafted script to the |
| parseDirectives function. |
| cves: |
| - CVE-2023-49559 |
| ghsas: |
| - GHSA-2hmf-46v7-v6fx |
| unknown_aliases: |
| - CGA-28jv-3vhj-mh4f |
| - CGA-f2h6-vhfv-9wfh |
| - CGA-pq49-565p-4jxc |
| - CGA-qxv7-23p6-xhwj |
| - CGA-r238-8h2v-2g64 |
| - CGA-vq2h-9hfx-rqr4 |
| references: |
| - advisory: https://github.com/advisories/GHSA-2hmf-46v7-v6fx |
| - fix: https://github.com/vektah/gqlparser/commit/36a3658873bf5a107f42488dfc392949cdd02977 |
| - web: https://gist.github.com/uvzz/d3ed9d4532be16ec1040a2cf3dfec8d1 |
| - web: https://github.com/99designs/gqlgen/issues/3118 |
| - web: https://github.com/vektah/gqlparser/blob/master/parser/query.go#L316 |
| source: |
| id: GHSA-2hmf-46v7-v6fx |
| created: 2024-07-01T13:30:21.392218-04:00 |
| review_status: REVIEWED |
