Asymmetric Resource Consumption (Amplification) in GraphQL server - #VU159304
Published: November 4, 2026
Vulnerability identifier: #VU159304
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-405
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by exhausting server CPU and memory resources.
The vulnerability exists due to asymmetric resource consumption in the graphql-go query executor when processing operations containing nested fragment spreads. A remote attacker can submit a crafted GraphQL operation that causes the same selections to be expanded repeatedly to exhaust server resources and interrupt service.
Affected software
GraphQL server
Remediation
Install security update from vendor's website.
GraphQL server - update to 1.11.0