CVE-2022-37734: Denial of Service via GraphQL query in graphql-java
Summary
CVE-2022-37734: graphql-java vulnerable to Denial of Service via GraphQL query that consumes CPU resources. Affects com.graphql-java:graphql-java across 2 version ranges.
< 17.4
>= 18.0, < 18.3
Fixed in 17.4 or 18.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
graphql-java is a Java library for implementing GraphQL servers and clients. It provides a powerful API for parsing, validating, and executing GraphQL queries. The library is widely used in Java applications that leverage GraphQL for data querying and manipulation. However, versions before 19.0, 18.3, and 17.4 of graphql-java are vulnerable to a Denial of Service (DoS) attack. An attacker can exploit this vulnerability by sending a malicious GraphQL query that consumes excessive CPU resources, leading to a degradation in performance or even a complete service outage.
Vulnerability Detail
The vulnerability in graphql-java allows an attacker to launch a DoS attack by sending a specially crafted GraphQL query. This query is designed to consume a significant amount of CPU resources, causing the server to become unresponsive or slow down significantly. The vulnerability arises from a lack of proper query validation and resource consumption control in the library. As a result, an attacker can exploit this weakness to exhaust the server's computing resources, impacting the availability and performance of the GraphQL service.
How To Fix
Latest published version: 230521-nf-execution as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 17.417.4 -
>= 18.0, < 18.318.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions of graphql-java to mitigate the risk of a DoS attack.
Conclusion
The vulnerability in graphql-java exposes applications to a Denial of Service (DoS) attack, where an attacker can send malicious GraphQL queries to consume excessive CPU resources. To mitigate this risk, it is crucial to upgrade to the fixed versions of graphql-java (19.0, 18.3, or 17.4). These versions include patches that address the vulnerability and prevent the execution of malicious queries. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.graphql-java:graphql-java →
FAQ
graphql-java is a Java library for implementing GraphQL servers and clients. It provides a powerful API for parsing, validating, and executing GraphQL queries.
A Denial of Service (DoS) attack is an attempt to disrupt the availability or performance of a computer system or network by overwhelming it with a flood of illegitimate requests or by consuming excessive resources.
An attacker can exploit this vulnerability by sending a malicious GraphQL query that consumes excessive CPU resources, causing the GraphQL service to become unresponsive or slow down significantly.
The fixed versions of graphql-java are 19.0, 18.3, and 17.4. It is recommended to upgrade to one of these versions to mitigate the vulnerability.
No, there is no known workaround for this vulnerability. Upgrading to the fixed versions of graphql-java is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.graphql-java:graphql-java.
