GCVE - cpe:2.3:a:graphql-go_project:graphql-go:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:graphql-go_project:graphql-go:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Graphql Go Project (`bfdf8668-0061-5716-bdb8-b3d91a489743`)
Product	Graphql Go (`bf97aed9-72b2-5d65-adf9-4279f3861439`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL	Source	Last updated
`pkg:github/graph-gophers/graphql-go`	purl2cpe	2026-06-01 10:12:35.979272
`pkg:golang/github.com/graph-gophers/graphql-go`	purl2cpe	2026-06-01 10:12:35.979274

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-37315`	vulnerable	2026-06-08 05:47:12.146597	Details available graphql-go (aka GraphQL for Go) through 0.8.0 has infinite recursion in the type definition parser. Published: 2022-08-01T21:53:26.000Z Updated: 2026-08-25T18:08:38.386Z Open on db.gcve.eu Reference links https://github.com/graphql-go/graphql/issues/637	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-21708`	vulnerable	2026-06-08 05:40:02.056031	Denial of Service in graphql-go MEDIUM (6.5) graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows. This in turn could potentially compromise the ability of the server to serve data to its users. The issue has been patched in version `v1.3.0`. The only known workaround for this issue is to disable the `graphql.MaxDepth` option from your schema which is not recommended. Published: 2022-01-21T22:25:10.000Z Updated: 2025-04-23T19:09:37.494Z Open on db.gcve.eu Reference links https://github.com/graph-gophers/graphql-go/security/advisories/GHSA-mh3m-8c74-74xh https://github.com/graph-gophers/graphql-go/commit/eae31ca73eb3473c544710955d1dbebc22605bfe	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.