CVE-2022-37734
graphql-java vulnerable to Denial of Service via GraphQL query that consumes CPU resources
graphql-java before19.0 is vulnerable to Denial of Service. An attacker can send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0 and later, 18.3, and 17.4, and 0.0.0-2022-07-26T05-45-04-226aabd9.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
graphql-java before19.0 is vulnerable to Denial of Service. An attacker can send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0 and later, 18.3, and 17.4, and 0.0.0-2022-07-26T05-45-04-226aabd9.
- Record
CVE-2022-37734- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
CVE List No score
graphql-java before19.0 is vulnerable to Denial of Service. An attacker can send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0 and later, 18.3, and 17.4, and 0.0.0-2022-07-26T05-45-04-226aabd9.
- Record
CVE-2022-37734- Updated
- 2026-11-02
EUVDEUVD-2022-6942 No score
graphql-java before19.0 is vulnerable to Denial of Service. An attacker can send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0 and later, 18.3, and 17.4, and 0.0.0-2022-07-26T05-45-04-226aabd9.
- Record
EUVD-2022-6942- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v62j-cxhh-fq22
graphql-java vulnerable to Denial of Service via GraphQL query that consumes CPU resources
graphql-java before 19.0, 18.3, and 17.4 is vulnerable to Denial of Service. An attacker send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0, 18.3, and 17.4.
- Record
GHSA-v62j-cxhh-fq22- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-v62j-cxhh-fq22
graphql-java vulnerable to Denial of Service via GraphQL query that consumes CPU resources
graphql-java before 19.0, 18.3, and 17.4 is vulnerable to Denial of Service. An attacker send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0, 18.3, and 17.4.
- Record
GHSA-v62j-cxhh-fq22- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV No score
graphql-java before19.0 is vulnerable to Denial of Service. An attacker can send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0 and later, 18.3, and 17.4, and 0.0.0-2022-07-26T05-45-04-226aabd9.
- Record
CVE-2022-37734- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2022-37734 No score
CVE-2022-37734 in com.graphql-java:graphql-java - Patched by Root
Root has patched CVE-2022-37734 in the com.graphql-java:graphql-java package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2022-37734- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.graphql-java:graphql-javaMaven |
before 17.4 | 17.4 |
com.graphql-java:graphql-javaMaven |
18.0 up to 18.3 | 18.3 |
com.graphql-java:graphql-javaMaven |
before 17.4, plus listed versions 0.0.0-2021-05-04T21-12-03-d3ac10b00.0.0-2021-05-05T05-30-31-080c6a390.0.0-2021-05-12T17-44-41-b9caa0b00.0.0-2021-05-17T01-01-51-5ec03a8b0.0.0-2021-05-17T23-49-29-83942204 Show 45 moreShow less0.0.0-2021-05-20T01-15-22-fdd8d1a70.0.0-2021-05-24T05-16-34-3139ccbb0.0.0-2021-05-24T05-25-51-5060b63c0.0.0-2021-05-25T00-50-29-f2c5f5f60.0.0-2021-05-28T01-59-18-ee8078a30.0.0-2021-05-28T21-23-19-9808fa380.0.0-2021-05-30T23-35-49-3dff821c0.0.0-2021-06-01T04-42-05-1a1070870.0.0-2021-06-05T04-28-09-ba39be3b0.0.0-2021-06-11T01-43-18-c5b814ca0.0.0-2021-06-16T04-31-20-2cea0afb0.0.0-2021-06-21T12-39-43-f4b349520.0.0-2021-06-22T01-59-26-ead753870.0.0-2021-06-22T19-29-39-93e076630.0.0-2021-06-23T06-44-45-89f328c00.0.0-2021-06-23T10-00-51-d5e4ea5e0.0.0-2021-06-23T21-05-17-344cb8a70.0.0-2021-06-27T12-21-06-f64601920.0.0-2021-06-27T12-22-33-cd2bab760.0.0-2021-06-29T03-35-30-5396ab200.0.0-2021-07-04T05-44-34-011ea7000.0.0-2021-07-04T08-25-52-86c0611a0.0.0-2021-07-04T08-49-40-2d15b5f90.0.0-2021-07-05T07-10-14-d5cc61c80.0.0-2021-07-05T07-18-25-966882f80.0.0-2021-07-05T07-19-30-e65342c80.0.0-2021-07-05T08-22-43-53fd88950.0.0-2021-07-05T12-04-02-38fee78e0.0.0-2021-07-05T12-04-42-97855c670.0.0-2021-07-05T12-13-02-5eb2c4770.0.0-2021-07-06T00-28-13-573087f70.0.0-2021-07-06T01-14-42-efe422420.0.0-2021-07-06T01-36-09-02444b780.0.0-2021-07-07T20-55-42-087dc8420.0.0-2021-07-08T03-59-17-e6367faa0.0.0-2021-07-09T22-23-59-0d451ba80.0.0-2021-07-10T05-17-50-2b651a9c0.0.0-2021-07-10T05-21-10-6515fa6a0.0.0-2021-07-12T21-51-47-98920d4d0.0.0-2021-07-12T21-52-29-6e7dec3c0.0.0-2021-07-12T21-54-17-deb56b650.0.0-2021-07-12T22-08-09-9289f25e0.0.0-2021-07-12T22-14-11-68c6db2d0.0.0-2021-07-13T05-18-08-2f6800860.0.0-2021-07-13T05-18-09-1bdbb8fa |
17.4 |
com.graphql-java:graphql-javaMaven |
18.0 up to 18.3, plus listed versions 18.118.2 |
18.3 |
com.graphql-java:graphql-javaRoot:Maven |
before 16.2-aikido.1 | 16.2-aikido.1 |
io.root.com.graphql-java:graphql-javaRoot:Maven |
before 16.2-root.io.1 | 16.2-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-37734 is a high vulnerability (CVSS 7.5) in Graphql-java Project Graphql-java, published September 12, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.79%, the 86th percentile. Fixed in com.graphql-java:graphql-java 17.4.
References
github.com/graphql-java/graphql-java/issues/2888
nvd.nist.gov/vuln/detail/CVE-2022-37734
security.snyk.io/vuln/SNYK-JAVA-COMGRAPHQLJAVA-3021519
Left out here: 1,030 versions. The JSON record has them.