GHSA-34cw-x8g7-rcv5
Stack overflow on deeply nested GraphQL documents
GHSA-34cw-x8g7-rcv5 is a high vulnerability (CVSS 7.5) in juniper, published October 28, 2026. No source lists public exploit code. Fixed in juniper 0.17.2.
- Severity
- 7.5 HighCVSS 3.1, OSV
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.17.2juniper
Description
The parser of juniper called itself once for each level of nesting in a GraphQL document. The parser had no limit on the nesting depth. Deeply nested selection sets, input values, and list types thus overflowed the stack of the thread that parsed the document. Validation and execution followed fragment spreads in the same recursive way. Long chains of fragment spreads thus overflowed the stack in validation and execution.
A stack overflow aborts the whole process. One request can thus stop a server and drop all other requests in progress. The request needs no authentication.
juniper 0.17.2 rejects documents that nest deeper than 64 levels or contain more than 15,000 tokens. RootNode::limit_depth() and RootNode::limit_tokens() change the limits.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
junipercrates.io | 0.0.0-0 up to 0.17.2 | 0.17.2 |
What each source reports
OSV Score usedRUSTSEC-2026-0416
Stack overflow on deeply nested GraphQL documents
The parser of juniper called itself once for each level of nesting in a GraphQL document. The parser had no limit on the nesting depth. Deeply nested selection sets, input values, and list types thus overflowed the stack of the thread that parsed the document. Validation and execution followed fragment spreads in the same recursive way. Long chains of fragment spreads thus overflowed the stack in validation and execution.
A stack overflow aborts the whole process. One request can thus stop a server and drop all other requests in progress. The request needs no authentication.
juniper 0.17.2 rejects documents that nest deeper than 64 levels or contain more than 15,000 tokens. RootNode::limit_depth() and RootNode::limit_tokens() change the limits.
- Record
RUSTSEC-2026-0416- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.