Stack overflow on deeply nested GraphQL documents
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.17.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The `juniper` Rust library for GraphQL is affected: a single crafted, deeply nested GraphQL request can overflow the stack during parsing, validation, or execution, crashing the entire server process and dropping all other in-progress requests. No authentication is required to trigger it.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The parser of `juniper` called itself once for each level of nesting in a GraphQL document. The parser had no limit on the nesting depth. Deeply nested selection sets, input values, and list types thus overflowed the stack of the thread that parsed the document. Validation and execution followed fragment spreads in the same recursive way. Long chains of fragment spreads thus overflowed the stack in validation and execution. A stack overflow aborts the whole process. One request can thus stop a server and drop all other requests in progress. The request needs no authentication. `juniper` 0.17.2 rejects documents that nest deeper than 64 levels or contain more than 15,000 tokens. `RootNode::limit_depth()` and `RootNode::limit_tokens()` change the limits.
Timeline
- Advisory published
- Record last updated
- First seen by cve.now
Affected versions
- junipercrates.io
From 0.0.0-0 · fixed in 0.17.2