What’s Vulnerable › Vulnerabilities

CVE-2022-30288

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-05-04 · updated 2026-06-17

Description

Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors.

Affected products

• agoo: before 2.14.3 — fixed in 2.14.3

How to fix

Upgrade to a fixed version: agoo 2.14.3. Check the vendor advisory for mitigations.

References

• https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/agoo.md
• https://github.com/ohler55/agoo/issues/109
• https://spec.graphql.org/October2021/#sec-Fragment-spreads-must-not-form-cycles
• https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/agoo.md
• https://github.com/ohler55/agoo/issues/109
• https://spec.graphql.org/October2021/#sec-Fragment-spreads-must-not-form-cycles

Get alerted when CVE-2022-30288 or the next vulnerability affects your stack