What’s Vulnerable › Vulnerabilities

CVE-2022-37734

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-12 · updated 2026-06-17

Description

graphql-java before19.0 is vulnerable to Denial of Service. An attacker can send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0 and later, 18.3, and 17.4, and 0.0.0-2022-07-26T05-45-04-226aabd9.

Affected products

• Graphql-Java Project Graphql-Java: before 17.4; from 18.0 before 18.3 — fixed in 17.4, 18.3

How to fix

Upgrade to a fixed version: Graphql-Java Project Graphql-Java 17.4, 18.3. Check the vendor advisory for mitigations.

References

• https://github.com/graphql-java/graphql-java/discussions/2958
• https://github.com/graphql-java/graphql-java/issues/2888
• https://github.com/graphql-java/graphql-java/pull/2892
• https://github.com/graphql-java/graphql-java/releases
• https://github.com/graphql-java/graphql-java/discussions/2958
• https://github.com/graphql-java/graphql-java/issues/2888
• https://github.com/graphql-java/graphql-java/pull/2892
• https://github.com/graphql-java/graphql-java/releases

Get alerted when CVE-2022-37734 or the next vulnerability affects your stack