CVE Feed

    Dashboard / CVE / CVE-2024-40094

    CVE-2024-40094

    GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.

    Published:Jul 30, 2024
    Last Modified:Apr 15, 2026
    EPS:Jul 30, 2024
    EPSS Score:0.1753
    CVSS Score:5.3

    Affected Products

    Vendor
    Redhat
    Product
    Cryostat
    Vendor
    Redhat
    Product
    Openshift Serverless
    Vendor
    Redhat
    Product
    Quarkus

    Exploits

    https://github.com/kabiri-labs/CVE-2024-40094

    Related CVEs

    CVE-2025-8415 (CVSS 5.9) — A vulnerability was found in the Cryostat HTTP API. Cryostat's HTTP API binds to all network interfaces, allow…
    CVE-2025-49146 (CVSS 8.2) — pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver…
    CVE-2025-48734 (CVSS 8.8) — Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in vers…
    CVE-2025-22871 (CVSS 9.1) — The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This …
    CVE-2025-30204 (CVSS 7.5) — golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 an…
    CVE-2025-22868 (CVSS 7.5) — An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.…
    CVE-2024-45338 (CVSS 5.3) — An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its…
    CVE-2024-12397 (CVSS 7.4) — A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in…
    CVE-2024-12401 (CVSS 4.4) — A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the ce…
    CVE-2024-45801 (CVSS 7.3) — DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discove…

    References

    https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a
    https://github.com/graphql-java/graphql-java/discussions/3641
    https://github.com/graphql-java/graphql-java/pull/3539
    https://github.com/graphql-java/graphql-java/releases/tag/v19.11
    https://github.com/graphql-java/graphql-java/releases/tag/v20.9
    https://github.com/graphql-java/graphql-java/releases/tag/v21.5
    https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a
    https://github.com/graphql-java/graphql-java/discussions/3641
    https://github.com/graphql-java/graphql-java/pull/3539
    https://github.com/graphql-java/graphql-java/releases/tag/v19.11
    https://github.com/graphql-java/graphql-java/releases/tag/v20.9
    https://github.com/graphql-java/graphql-java/releases/tag/v21.5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High