Description
A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat build of Quarkus 3.27.5.SP1
Default version status: affected
2.14.2.redhat-00002 to < *unaffected
Red Hat Red Hat build of Quarkus 3.33.3.SP1
Default version status: affected
2.17.0.redhat-00003 to < *unaffected