CVE-2022-37734: Uncontrolled Resource Consumption

September 12, 2022 (updated August 8, 2023)

graphql-java before19.0 is vulnerable to Denial of Service. An attacker can send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0 and later, 18.3, and 17.4.

References

github.com/graphql-java/graphql-java/discussions/2958
github.com/graphql-java/graphql-java/issues/2888
github.com/graphql-java/graphql-java/pull/2892
github.com/graphql-java/graphql-java/releases
nvd.nist.gov/vuln/detail/CVE-2022-37734

Code Behaviors & Features

Detect and mitigate CVE-2022-37734 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →