Go/github.com/vektah/gqlparser CVE-2023-49559: medium 5.3, EPSS 0.60%

gqlparser denial of service vulnerability via the parserDirectives function

Action: Upgrade github.com/vektah/gqlparser to 2.5.14 or later.

go get github.com/vektah/gqlparser@v2.5.14

Affected

Fixed versions

Sources

• osv: GHSA-2hmf-46v7-v6fx#Go/github.com/vektah/gqlparser
• https://nvd.nist.gov/vuln/detail/CVE-2023-49559
• https://github.com/99designs/gqlgen/issues/3118
• https://github.com/vektah/gqlparser/commit/36a3658873bf5a107f42488dfc392949cdd02977
• https://gist.github.com/uvzz/d3ed9d4532be16ec1040a2cf3dfec8d1
• https://github.com/advisories/GHSA-2hmf-46v7-v6fx
• https://github.com/vektah/gqlparser
• https://github.com/vektah/gqlparser/blob/master/parser/query.go#L316

CVE-2023-49559 · published 2024-06-12T21:31:19Z · modified 2026-09-10T03:50:14.729633897Z · JSON