{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/vektah/gqlparser","cve_ids":["CVE-2023-49559"],"ecosystem":"Go","epss":0.00595,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-2hmf-46v7-v6fx","id":"tcs_01M5KG3PTV61KXQED5F3SBX6GC","modified_at":"2026-02-04T02:19:19.852945Z","published_at":"2024-07-01T19:59:12Z","references":["https://osv.dev/vulnerability/GO-2024-2920","https://github.com/advisories/GHSA-2hmf-46v7-v6fx","https://github.com/vektah/gqlparser/commit/36a3658873bf5a107f42488dfc392949cdd02977","https://gist.github.com/uvzz/d3ed9d4532be16ec1040a2cf3dfec8d1","https://github.com/99designs/gqlgen/issues/3118","https://github.com/vektah/gqlparser/blob/master/parser/query.go#L316"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2024-2920","url":"https://osv.dev/vulnerability/GO-2024-2920"}],"summary":"Denial of service vulnerability via the parseDirectives function in github.com/vektah/gqlparser"}