CVE-2023-28867: GraphQL Java - Stack Consumption Vulnerability
Summary
CVE-2023-28867: GraphQL Java vulnerable to stack consumption. Affects com.graphql-java:graphql-java across 5 version ranges.
< 0.0.0-2023-03-20T01-49-44-80e3135
>= 1.2, < 17.5
>= 18.0, < 18.4
>= 19.0, < 19.4
>= 20.0, < 20.1
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GraphQL Java (graphql-java) is an open-source library that provides a Java implementation of the GraphQL specification. It allows developers to build and execute GraphQL queries and mutations in Java applications. The library is widely used in various Maven projects. However, a vulnerability has been discovered in versions before 20.1, which can lead to stack consumption.
Vulnerability Detail
The vulnerability in GraphQL Java allows an attacker to send a specially crafted GraphQL query that triggers excessive stack consumption. This can potentially lead to a denial-of-service (DoS) condition, causing the application to become unresponsive or crash. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 230521-nf-execution as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.0.0-2023-03-20T01-49-44-80e31350.0.0-2023-03-20T01-49-44-80e3135 -
>= 1.2, < 17.517.5 -
>= 18.0, < 18.418.4 -
>= 19.0, < 19.419.4 -
>= 20.0, < 20.120.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed versions mentioned above to mitigate the risk of exploitation.
Conclusion
The GraphQL Java library is vulnerable to a stack consumption issue that can lead to a denial-of-service condition. It is crucial for developers to update their projects to the fixed versions to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for com.graphql-java:graphql-java →
FAQ
GraphQL Java is a library that provides a Java implementation of the GraphQL specification. It allows developers to build and execute GraphQL queries and mutations in Java applications.
The vulnerability can lead to excessive stack consumption, potentially causing a denial-of-service (DoS) condition in the affected application.
To fix the vulnerability, update the affected version of GraphQL Java to one of the fixed versions: 20.1, 19.4, 18.4, 17.5, or 0.0.0-2023-03-20T01-49-44-80e3135.
No, there is no known workaround for this vulnerability. It is essential to update to the fixed versions to mitigate the risk.
You can find more information about this vulnerability, including its technical details and the fixed versions, in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-p4qx-6w5p-4rj2/GHSA-p4qx-6w5p-4rj2.json
Related vulnerabilities
Recent vulnerabilities recorded for com.graphql-java:graphql-java.
