7.5

CVE-2026-35401

Saleor has a resource exhaustion vulnerability in GraphQL queries

Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a malicious actor can include many GraphQL mutations or queries in a single API call using aliases or chaining multiple mutations, resulting in resource exhaustion. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Saleor ≫ Saleor Version >= 2.0.0 < 3.20.118
Saleor ≫ Saleor Version >= 3.21.0 < 3.21.54
Saleor ≫ Saleor Version >= 3.22.0 < 3.22.47
Saleor ≫ Saleor Version3.23.0 Updatealpha0
Saleor ≫ Saleor Version3.23.0 Updatealpha1
Saleor ≫ Saleor Version3.23.0 Updatealpha2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.182
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

https://github.com/saleor/saleor/security/advisories/GHSA-gqqv-xwx3-jj4h
Patch
Vendor Advisory