CVE-2024-40094

EUVD-2024-2357
GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CISA-ADPADP
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 94%
References
https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a
https://github.com/graphql-java/graphql-java/discussions/3641
https://github.com/graphql-java/graphql-java/pull/3539
https://github.com/graphql-java/graphql-java/releases/tag/v19.11
https://github.com/graphql-java/graphql-java/releases/tag/v20.9
https://github.com/graphql-java/graphql-java/releases/tag/v21.5
https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a
https://github.com/graphql-java/graphql-java/discussions/3641
https://github.com/graphql-java/graphql-java/pull/3539
https://github.com/graphql-java/graphql-java/releases/tag/v19.11
https://github.com/graphql-java/graphql-java/releases/tag/v20.9
https://github.com/graphql-java/graphql-java/releases/tag/v21.5