Resource exhaustion in graphql-js - CVE-2023-26144
Published: October 26, 2023
Vulnerability identifier: #VU82441
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-26144
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
Affected software
graphql-js
Migration Toolkit for Virtualization
IBM Edge Application Manager
IBM Security QRadar Analyst Workflow
IBM Cloud Pak for Watson AIOps
Migration Toolkit for Virtualization
IBM Edge Application Manager
IBM Security QRadar Analyst Workflow
IBM Cloud Pak for Watson AIOps
How to mitigate CVE-2023-26144
Install updates from vendor's website.
graphql-js - update to 16.8.1
Migration Toolkit for Virtualization - update to 2.5.2
IBM Security QRadar Analyst Workflow - update to 2.32.0
IBM Cloud Pak for Watson AIOps - update to 4.2.1
Migration Toolkit for Virtualization - update to 2.5.2
IBM Security QRadar Analyst Workflow - update to 2.32.0
IBM Cloud Pak for Watson AIOps - update to 4.2.1