https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-03T03:55:49.789224+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2024-39895 fkie_cve-2024-39895 2026-10-03T03:55:49.791332+00:00

Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users. Request to the endpoint /graphql are sent when visualizing graphs generated at a dashboard. By modifying the data sent and duplicating many times the fields a DoS attack is possible. This vulnerability is fixed in 10.12.0.

 https://vulnerability.circl.lu/vuln/ghsa-7hmh-pfrp-vcx4 GHSA-7hmh-pfrp-vcx4 — Directus GraphQL Field Duplication Denial of Service (DoS) 2026-10-03T03:55:49.791424+00:00

Affected: npm: @directus/env

### Summary A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users.

### Details Request to the endpoint /graphql are sent when visualizing graphs generated at a dashboard: ![image](https://github.com/directus/directus/assets/114263468/185eb60f-9092-47d4-81f4-add1a53e99c8)

![DoS5](https://github.com/directus/directus/assets/114263468/f43079f5-b9ab-4704-938f-dcb91453d464)

By modifying the data sent and duplicating many times the fields a DoS attack is possible.

### PoC The goal is to create a payload that generates a body like this, where the 'max' field is duplicated many times, each with the 'id' field duplicated many times inside it. `{'query': 'query { query_4f4722ea: test_table_aggregated { max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } } }'}`

Although that payload seems harmless, a bigger one leaves the service unresponsive.

T…