Security Exception in GraphQL Parser - graphql-java Vulnerability
Summary
OSV-2025-215: Security exception in graphql.parser.GraphqlAntlrToLanguage.createType. Affects graphql-java versions >= f52305325593dcec70aba9c4a5717b18b6543fa0, < 9c927258ecbf5befa9990c134deb752835bcee9d. Fixed in 9c927258ecbf5befa9990c134deb752835bcee9d. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
graphql-java is a popular library that provides a Java implementation of the GraphQL specification. It allows developers to build GraphQL APIs in Java, enabling efficient data retrieval and manipulation. The library is widely used due to its flexibility and adherence to the GraphQL standard. However, it has been identified to have a security vulnerability that can lead to exceptions during parsing operations, potentially affecting application stability and security.
Vulnerability Detail
The vulnerability originates from a security exception in the GraphQL parser, specifically within the GraphqlAntlrToLanguage class. The crash occurs during the creation of types, such as list types and non-null types, which can lead to unexpected behavior or crashes in applications utilizing this library. If exploited, this vulnerability could allow attackers to disrupt service or manipulate data retrieval processes.
How To Fix
Minimum fixed version
9c927258ecbf5befa9990c134deb752835bcee9d
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to ensure that the data being parsed does not lead to the creation of problematic types. This can help mitigate the risk of encountering the security exception until the package is updated.
Conclusion
In summary, the graphql-java library has a security vulnerability that can lead to exceptions during parsing operations. It is crucial to update to the patched version to ensure application stability and security. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for graphql-java →
FAQ
The vulnerability is a security exception that occurs during the parsing of GraphQL types, which can lead to application crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground without needing to sign up.
Exploiting this vulnerability can lead to application instability, crashes, and potential data manipulation issues.
Yes, a patched version of graphql-java is available. It is recommended to update to version 9c927258ecbf5befa9990c134deb752835bcee9d.
If immediate updates are not possible, implement input validation as a temporary workaround to reduce the risk of encountering the security exception.
References
Related vulnerabilities
Recent vulnerabilities recorded for graphql-java.
