Denial of Service Vulnerability in gqlparser
Summary
CVE-2023-49559: gqlparser denial of service vulnerability via the parserDirectives function. Affects github.com/vektah/gqlparser/v2 versions < 2.5.14. Fixed in 2.5.14. How to fix ↓
Also tracked for
The same CVE-2023-49559 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gqlparser is an open-source library written in Go that provides functionality for parsing GraphQL queries. It is commonly used in Go applications to handle GraphQL requests. The library allows developers to parse and validate GraphQL queries, making it easier to work with GraphQL APIs. However, a vulnerability has been discovered in gqlparser version 2.5.10 that can be exploited by a remote attacker to cause a denial of service (DoS) attack. This vulnerability exists in the parserDirectives function of the library.
Vulnerability Detail
The vulnerability in gqlparser arises from a flaw in the parserDirectives function. By providing a specially crafted script to this function, a remote attacker can trigger a DoS attack. The attacker can exploit this vulnerability to overload the parserDirectives function, causing it to consume excessive resources and potentially crash the application. This can lead to service disruption and impact the availability of the affected application. The vulnerability has been assigned a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: v2.5.64 as of 23 Oct 2026
go get github.com/vektah/gqlparser/v2@v2.5.64Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5.14
This is the first release that contains the fix.
go get github.com/vektah/gqlparser/v2@v2.5.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended approach is to upgrade to the fixed version of gqlparser.
Conclusion
In conclusion, gqlparser version 2.5.10 is vulnerable to a denial of service attack. To mitigate this vulnerability, it is crucial to upgrade to gqlparser version 2.5.14 or later. This upgrade will ensure that the parserDirectives function is protected against the DoS attack. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for github.com/vektah/gqlparser/v2 →
FAQ
gqlparser is an open-source library written in Go that provides functionality for parsing GraphQL queries. It is commonly used in Go applications to handle GraphQL requests.
The vulnerability allows a remote attacker to cause a denial of service (DoS) attack by overloading the parserDirectives function of gqlparser. This can lead to service disruption and impact the availability of the affected application.
The vulnerability has been assigned a CVSS score of 5.3, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to gqlparser version 2.5.14 or later.
There is no specific workaround provided for this vulnerability. The recommended approach is to upgrade to the fixed version of gqlparser.
