Description
GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://github.com/graphql-java/graphql-java/releases/tag/v21.5 ↗
- https://github.com/graphql-java/graphql-java/releases/tag/v20.9 ↗
- https://github.com/graphql-java/graphql-java/releases/tag/v19.11 ↗
- https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a ↗
- https://github.com/graphql-java/graphql-java/discussions/3641 ↗
- https://github.com/graphql-java/graphql-java/pull/3539 ↗