What’s Vulnerable › Vulnerabilities

CVE-2023-28867

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-27 · updated 2026-06-17
• Weakness: CWE-770

Description

In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.

Affected products

• Graphql-Java: before 17.5; from 18.0 before 18.4; from 19.0 before 19.4; 20.0 — fixed in 17.5, 18.4, 19.4

How to fix

Upgrade to a fixed version: Graphql-Java 17.5, 18.4, 19.4. Check the vendor advisory for mitigations.

References

• https://github.com/graphql-java/graphql-java/pull/3112
• https://github.com/graphql-java/graphql-java/releases/tag/v17.5
• https://github.com/graphql-java/graphql-java/releases/tag/v18.4
• https://github.com/graphql-java/graphql-java/releases/tag/v19.4
• https://github.com/graphql-java/graphql-java/releases/tag/v20.1
• https://github.com/graphql-java/graphql-java/pull/3112
• https://github.com/graphql-java/graphql-java/releases/tag/v17.5
• https://github.com/graphql-java/graphql-java/releases/tag/v18.4
• https://github.com/graphql-java/graphql-java/releases/tag/v19.4
• https://github.com/graphql-java/graphql-java/releases/tag/v20.1

Get alerted when CVE-2023-28867 or the next vulnerability affects your stack