#VU98137 Allocation of Resources Without Limits or Throttling in GraphQL Java - CVE-2024-40094

Vulnerability identifier: #VU98137

Vulnerability risk: Medium

CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2024-40094

CWE-ID: CWE-770

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
GraphQL Java
Universal components / Libraries / Software for developers

Vendor: GraphQL Java

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to GraphQL Java (aka graphql-java) does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

GraphQL Java: before 21.5, 21.5

---

External links
https://github.com/graphql-java/graphql-java/releases/tag/v21.5
https://github.com/graphql-java/graphql-java/releases/tag/v20.9
https://github.com/graphql-java/graphql-java/releases/tag/v19.11
https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a
https://github.com/graphql-java/graphql-java/discussions/3641
https://github.com/graphql-java/graphql-java/pull/3539

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.