CVE-2022-31173

    Dashboard / Vulnerabilities / CVE-2022-31173

    CVE-2022-31173

    Published: 1 Aug 2022Last Modified: 12 Aug 2026

    Summary: Juniper is vulnerable to @DOS GraphQL Nested Fragments overflow

    Details: Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue has been addressed in version 0.15.10. Users are advised to upgrade. Users unable to upgrade should limit the recursion depth manually.

    References: https://github.com/graphql-rust/juniper/blob/juniper-v0.15.10/juniper/CHANGELOG.md#01510-2022-07-28, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31173.json, https://github.com/graphql-rust/juniper/security/advisories/GHSA-4rx6-g5vg-5f3j, https://nvd.nist.gov/vuln/detail/CVE-2022-31173, https://github.com/graphql-rust/juniper/commit/2b609ee057be950e3454b69fadc431d120e407bb, https://github.com/graphql-rust/juniper/commit/8d28cdba6eb10f53490ba41d1b5cb40506c2de22

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -6fd7a591cf43255712f102892a46c732ee193f9e

    Affected versions

    juniper_iron-v0.7.6
    juniper_iron-v0.7.5
    juniper_iron-v0.7.4
    juniper_iron-v0.7.3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31173 | CVE-DB