THREAT OPS › Threat News › graphql-go/graphql <= 0.8.1: quadratic CPU-exhaustion DoS from a single syntax error
graphql-go/graphql <= 0.8.1: quadratic CPU-exhaustion DoS from a single syntax error
<p>Posted by William Carrier on Aug 29</p>Hello,<br /> <br /> This reports an algorithmic-complexity denial-of-service defect in<br /> github.com/graphql-go/graphql, affecting all released versions up to and<br /> including the latest, v0.8.1. No fixed version exists. It is<br /> unauthenticated, network-reachable, triggered purely by attacker-controlled<br /> query text, and requires no special c
Original source: https://seclists.org/oss-sec/2026/q3/611