Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not proven that this vulnerability can crash the process.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
🔴 graphql-php, Algorithmic Complexity (DoS), #CVE-2023-26144 (Critical) https://dailycve.com/graphql-php-algorithmic-complexity-dos-cve-2023-26144-critical/
Post summary
The tweet highlights the discovery of a critical DoS vulnerability (Algorithmic Complexity) in graphql-php, labeled CVE‑2023‑26144, without mentioning exploits, patches, or activity reports.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | graphql | graphql | - | node.js | - |
| App | graphql | graphql | 17.0.0 | node.js | - |
| App | graphql | graphql | 17.0.0 | node.js | - |