CVE-2024-40094: High severity maven/com.graphql-java:graphql-java vulnerability
GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.
Other sources
GraphQL Java (aka graphql-java) is vulnerable to a denial of service, caused by the failure to properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service. By using introspection queries, a remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40094?
CVE-2024-40094 has been assessed as a denial of service vulnerability affecting versions of GraphQL Java prior to 21.5.
How do I fix CVE-2024-40094?
To remediate CVE-2024-40094, upgrade GraphQL Java to version 21.5, 20.9, or 19.11.
Which versions of GraphQL Java are affected by CVE-2024-40094?
CVE-2024-40094 affects versions of GraphQL Java before 21.5, including 20.0 to 20.9 and all versions prior to 19.11.
Is there a workaround for CVE-2024-40094?
No specific workarounds are mentioned for CVE-2024-40094, and the recommended action is to update to the fixed versions.
What is the impact of CVE-2024-40094?
The impact of CVE-2024-40094 is a potential denial of service via introspection queries that can overload the server handling such requests.