CVE-2024-39895: Directus GraphQL Field Duplication Denial of Service (DoS)

July 8, 2024 (updated November 18, 2024)

A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users.

References

github.com/advisories/GHSA-7hmh-pfrp-vcx4
github.com/directus/directus
github.com/directus/directus/commit/543b345695071c1de61a35004bd063fe59dba0c8
github.com/directus/directus/security/advisories/GHSA-7hmh-pfrp-vcx4
nvd.nist.gov/vuln/detail/CVE-2024-39895

Code Behaviors & Features

Detect and mitigate CVE-2024-39895 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →