high7.5
CVE-2022-30288
Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash.
Impact
Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ohler | Agoo | before 2.14.3 |
References
- NVD record
- CVE.org record
- https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/agoo.md
- https://github.com/ohler55/agoo/issues/109
- https://spec.graphql.org/October2021/#sec-Fragment-spreads-must-not-form-cycles
- https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/agoo.md
- https://github.com/ohler55/agoo/issues/109
- https://spec.graphql.org/October2021/#sec-Fragment-spreads-must-not-form-cycles