{"action":"Upgrade github.com/vektah/gqlparser to 2.5.14 or later.","affected":[{"fixed":"2.5.14","introduced":"0"}],"component":"github.com/vektah/gqlparser","cve_ids":["CVE-2023-49559"],"ecosystem":"Go","epss":0.00595,"exploited":false,"fixed_versions":["2.5.14"],"ghsa_id":"GHSA-2hmf-46v7-v6fx","id":"tcs_01M5KES8807RPHA102BVNBE8FK","modified_at":"2026-09-10T03:50:14.729633897Z","published_at":"2024-06-12T21:31:19Z","references":["https://osv.dev/vulnerability/GHSA-2hmf-46v7-v6fx","https://nvd.nist.gov/vuln/detail/CVE-2023-49559","https://github.com/99designs/gqlgen/issues/3118","https://github.com/vektah/gqlparser/commit/36a3658873bf5a107f42488dfc392949cdd02977","https://gist.github.com/uvzz/d3ed9d4532be16ec1040a2cf3dfec8d1","https://github.com/advisories/GHSA-2hmf-46v7-v6fx","https://github.com/vektah/gqlparser","https://github.com/vektah/gqlparser/blob/master/parser/query.go#L316"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-2hmf-46v7-v6fx#Go/github.com/vektah/gqlparser","url":"https://osv.dev/vulnerability/GHSA-2hmf-46v7-v6fx"}],"summary":"gqlparser denial of service vulnerability via the parserDirectives function"}