Skip to content
OpenAdvisories
Low · 3.7 CVE-2023-49559 EUVD-2024-1883GHSA-2hmf-46v7-v6fxGO-2024-2920

gqlparser denial of service vulnerability via the parserDirectives function

Published Jun 12, 2024 · Updated Dec 3, 2024 · Assigned by mitre

Package: dagger Package: github.com/vektah/gqlparser Package: github.com/vektah/gqlparser/v2 Package: guac Package: guaccsub Package: guacgql Package: guacingest Package: guacone Package: melange Package: zot Ecosystem: Go Ecosystem: Wolfi

Description

An issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the parserDirectives function.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling dagger 0.11.7-r1 —
Wolfi rolling guac +4 0.7.2-r2 —
Wolfi rolling melange 0.8.6-r1 —
Wolfi rolling zot 2.0.4-r6 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/vektah/gqlparser < 2.5.14 2.5.14 GHSA-2hmf-46v7-v6fx
Go github.com/vektah/gqlparser all versions — GO-2024-2920
Go github.com/vektah/gqlparser/v2 < 2.5.14 2.5.14 GHSA-2hmf-46v7-v6fx

References