CVE-2023-28867
GraphQL Java vulnerable to stack consumption
In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.
- Record
CVE-2023-28867- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
CVE List No score
In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.
- Record
CVE-2023-28867- Updated
- 2026-11-02
EUVDEUVD-2023-1064
In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.
- Record
EUVD-2023-1064- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p4qx-6w5p-4rj2
GraphQL Java vulnerable to stack consumption
In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.
- Record
GHSA-p4qx-6w5p-4rj2- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-p4qx-6w5p-4rj2
GraphQL Java vulnerable to stack consumption
In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.
- Record
GHSA-p4qx-6w5p-4rj2- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV No score
In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.
- Record
CVE-2023-28867- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2023-28867 No score
CVE-2023-28867 in com.graphql-java:graphql-java - Patched by Root
Root has patched CVE-2023-28867 in the com.graphql-java:graphql-java package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2023-28867- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.graphql-java:graphql-javaMaven |
before 0.0.0-2023-03-20T01-49-44-80e3135 | 0.0.0-2023-03-20T01-49-44-80e3135 |
com.graphql-java:graphql-javaMaven |
1.2 up to 17.5 | 17.5 |
com.graphql-java:graphql-javaMaven |
18.0 up to 18.4 | 18.4 |
com.graphql-java:graphql-javaMaven |
19.0 up to 19.4 | 19.4 |
com.graphql-java:graphql-javaMaven |
20.0 to 20.0 | 20.1 |
com.graphql-java:graphql-javaMaven |
before 0.0.0-2023-03-20T01-49-44-80e3135, plus listed versions 0.0.0-2021-05-04T21-12-03-d3ac10b00.0.0-2021-05-05T05-30-31-080c6a390.0.0-2021-05-12T17-44-41-b9caa0b00.0.0-2021-05-17T01-01-51-5ec03a8b0.0.0-2021-05-17T23-49-29-83942204 Show 45 moreShow less0.0.0-2021-05-20T01-15-22-fdd8d1a70.0.0-2021-05-24T05-16-34-3139ccbb0.0.0-2021-05-24T05-25-51-5060b63c0.0.0-2021-05-25T00-50-29-f2c5f5f60.0.0-2021-05-28T01-59-18-ee8078a30.0.0-2021-05-28T21-23-19-9808fa380.0.0-2021-05-30T23-35-49-3dff821c0.0.0-2021-06-01T04-42-05-1a1070870.0.0-2021-06-05T04-28-09-ba39be3b0.0.0-2021-06-11T01-43-18-c5b814ca0.0.0-2021-06-16T04-31-20-2cea0afb0.0.0-2021-06-21T12-39-43-f4b349520.0.0-2021-06-22T01-59-26-ead753870.0.0-2021-06-22T19-29-39-93e076630.0.0-2021-06-23T06-44-45-89f328c00.0.0-2021-06-23T10-00-51-d5e4ea5e0.0.0-2021-06-23T21-05-17-344cb8a70.0.0-2021-06-27T12-21-06-f64601920.0.0-2021-06-27T12-22-33-cd2bab760.0.0-2021-06-29T03-35-30-5396ab200.0.0-2021-07-04T05-44-34-011ea7000.0.0-2021-07-04T08-25-52-86c0611a0.0.0-2021-07-04T08-49-40-2d15b5f90.0.0-2021-07-05T07-10-14-d5cc61c80.0.0-2021-07-05T07-18-25-966882f80.0.0-2021-07-05T07-19-30-e65342c80.0.0-2021-07-05T08-22-43-53fd88950.0.0-2021-07-05T12-04-02-38fee78e0.0.0-2021-07-05T12-04-42-97855c670.0.0-2021-07-05T12-13-02-5eb2c4770.0.0-2021-07-06T00-28-13-573087f70.0.0-2021-07-06T01-14-42-efe422420.0.0-2021-07-06T01-36-09-02444b780.0.0-2021-07-07T20-55-42-087dc8420.0.0-2021-07-08T03-59-17-e6367faa0.0.0-2021-07-09T22-23-59-0d451ba80.0.0-2021-07-10T05-17-50-2b651a9c0.0.0-2021-07-10T05-21-10-6515fa6a0.0.0-2021-07-12T21-51-47-98920d4d0.0.0-2021-07-12T21-52-29-6e7dec3c0.0.0-2021-07-12T21-54-17-deb56b650.0.0-2021-07-12T22-08-09-9289f25e0.0.0-2021-07-12T22-14-11-68c6db2d0.0.0-2021-07-13T05-18-08-2f6800860.0.0-2021-07-13T05-18-09-1bdbb8fa |
0.0.0-2023-03-20T01-49-44-80e3135 |
com.graphql-java:graphql-javaMaven |
1.2 up to 17.5, plus listed versions 1.310.011.012.013.0 Show 36 moreShow less14.014.115.016.016.116.217.017.0-beta117.0.0-beta117.117.217.317.42.0.02.1.02.2.02.3.02.4.03.0.04.04.14.25.06.07.08.09.09.0-TEST9.0-rc19.19.29.39.49.4-rc19.59.7 |
17.5 |
com.graphql-java:graphql-javaMaven |
18.0 up to 18.4, plus listed versions 18.118.218.3 |
18.4 |
com.graphql-java:graphql-javaMaven |
19.0 up to 19.4, plus listed versions 19.119.219.3 |
19.4 |
com.graphql-java:graphql-javaMaven |
20.0 up to 20.1 | 20.1 |
com.graphql-java:graphql-javaRoot:Maven |
before 16.2-aikido.1 | 16.2-aikido.119.4-aikido.1 |
io.root.com.graphql-java:graphql-javaRoot:Maven |
before 16.2-root.io.1 | 16.2-root.io.119.4-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-28867 is a high vulnerability (CVSS 7.5) in Graphql-java, published March 27, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.06%, the 64th percentile. Fixed in com.graphql-java:graphql-java 0.0.0-2023-03-20T01-49-44-80e3135.
References
github.com/graphql-java/graphql-java/pull/3112
nvd.nist.gov/vuln/detail/CVE-2023-28867
Left out here: 279 versions. The JSON record has them.