CyberRota Analysis
AI-GeneratedThe vulnerability affects the GraphQL implementation in GitHub, specifically the graphql-go/graphql library up to version 0.8.1, which fails to validate scalar variable types properly. This oversight can lead to a stack overflow error when deeply nested values are processed, potentially causing application crashes. Organizations using this library should prioritize remediation to prevent service disruptions and ensure compliance with GraphQL specifications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions (scalars.go) accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising the request error that the GraphQL specification mandates. In some cases (but not any typical case of JSON sent to a website), a deeply nested value leads to an unrecoverable "fatal error: stack overflow" condition.