Go/github.com/vektah/gqlparser/v2 CVE-2023-49559: unknown, EPSS 0.60%
Denial of service vulnerability via the parseDirectives function in github.com/vektah/gqlparser
Action: Upgrade github.com/vektah/gqlparser/v2 to 2.5.14 or later.
go get github.com/vektah/gqlparser/v2@v2.5.14Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.5.14 | - |
Fixed versions
| 2.5.14 |
Sources
- osv: GO-2024-2920#Go/github.com/vektah/gqlparser/v2
- https://github.com/advisories/GHSA-2hmf-46v7-v6fx
- https://github.com/vektah/gqlparser/commit/36a3658873bf5a107f42488dfc392949cdd02977
- https://gist.github.com/uvzz/d3ed9d4532be16ec1040a2cf3dfec8d1
- https://github.com/99designs/gqlgen/issues/3118
- https://github.com/vektah/gqlparser/blob/master/parser/query.go#L316
CVE-2023-49559 · published · modified · JSON