https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 03:55:48 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2024-39895 <p>Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users. Request to the endpoint /graphql are sent when visualizing graphs generated at a dashboard. By modifying the data sent and duplicating many times the fields a DoS attack is possible. This vulnerability is fixed in 10.12.0.</p> <p>Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users. Request to the endpoint /graphql are sent when visualizing graphs generated at a dashboard. By modifying the data sent and duplicating many times the fields a DoS attack is possible. This vulnerability is fixed in 10.12.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2024-39895 https://vulnerability.circl.lu/vuln/ghsa-7hmh-pfrp-vcx4 <p><strong>Affected:</strong> npm: @directus/env</p> <p>### Summary A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users.</p> <p>### Details Request to the endpoint /graphql are sent when visualizing graphs generated at a dashboard: </p> <p></p> <p>By modifying the data sent and duplicating many times the fields a DoS attack is possible.</p> <p>### PoC The goal is to create a payload that generates a body like this, where the &#39;max&#39; field is duplicated many times, each with the &#39;id&#39; field duplicated many times inside it. `{&#39;query&#39;: &#39;query { query_4f4722ea: test_table_aggregated { max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } } }&#39;}`</p> <p>Although that payload seems harmless, a bigger one leaves the service unresponsive.</p> <p>T…</p> <p><strong>Affected:</strong> npm: @directus/env</p> <p>### Summary A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users.</p> <p>### Details Request to the endpoint /graphql are sent when visualizing graphs generated at a dashboard: </p> <p></p> <p>By modifying the data sent and duplicating many times the fields a DoS attack is possible.</p> <p>### PoC The goal is to create a payload that generates a body like this, where the &#39;max&#39; field is duplicated many times, each with the &#39;id&#39; field duplicated many times inside it. `{&#39;query&#39;: &#39;query { query_4f4722ea: test_table_aggregated { max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } max {id id id id id id id id id id } } }&#39;}`</p> <p>Although that payload seems harmless, a bigger one leaves the service unresponsive.</p> <p>T…</p> https://vulnerability.circl.lu/vuln/ghsa-7hmh-pfrp-vcx4