CVE-2024-50311
Graphql: denial of service (dos) vulnerability via graphql batching
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Graphql: denial of service (dos) vulnerability via graphql batching
A denial of service (DoS) vulnerability was found in OpenShift. This flaw allows attackers to exploit the GraphQL batching functionality. The vulnerability arises when multiple queries can be sent within a single request, enabling an attacker to submit a request containing thousands of aliases in one query. This issue causes excessive resource consumption, leading to application unavailability for legitimate users.
Reserved 2024-10-22 | Published 2024-10-22 | Updated 2025-02-25 | Assigner redhatAllocation of Resources Without Limits or Throttling
| 2024-10-17: | Reported to Red Hat. |
| 2024-10-17: | Made public. |
Red Hat would like to thank Maksymilian Kubiak (AFINE), Paweł Zdunek (AFINE), and Sławomir Zakrzewski (AFINE) for reporting this issue.
access.redhat.com/errata/RHSA-2024:6122 (RHSA-2024:6122)
access.redhat.com/security/cve/CVE-2024-50311
bugzilla.redhat.com/show_bug.cgi?id=2319379 (RHBZ#2319379)
Support options
