CVE-2022-21708

graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows. This in turn could potentially compromise the ability of the server to serve data to its users. The issue has been patched in version `v1.3.0`. The only known workaround for this issue is to disable the `graphql.MaxDepth` option from your schema which is not recommended.

• CWE-400
• CWE-674

• https://github.com/graph-gophers/graphql-go/commit/eae31ca73eb3473c544710955d1dbebc22605bfePatch, Third Party Advisory
• https://github.com/graph-gophers/graphql-go/security/advisories/GHSA-mh3m-8c74-74xhThird Party Advisory
• https://github.com/graph-gophers/graphql-go/commit/eae31ca73eb3473c544710955d1dbebc22605bfePatch, Third Party Advisory
• https://github.com/graph-gophers/graphql-go/security/advisories/GHSA-mh3m-8c74-74xhThird Party Advisory

Published

Jan 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21702Grafana is an open-source platform for monitoring and observ…5.4
• CVE-2022-21703Grafana is an open-source platform for monitoring and observ…8.8
• CVE-2022-21704log4js-node is a port of log4js to node.js. In affected vers…5.5
• CVE-2022-21705Octobercms is a self-hosted CMS platform based on the Larave…7.2
• CVE-2022-21706Zulip is an open-source team collaboration tool with topic-b…9.8
• CVE-2022-21707wasmCloud Host Runtime is a server process that securely hos…8.1
• CVE-2022-2171The Progressive License WordPress plugin through 1.1.0 is la…5.4
• CVE-2022-21710ShortDescription is a MediaWiki extension that provides loca…6.1
• CVE-2022-21711elfspirit is an ELF static analysis and injection framework …7.1
• CVE-2022-21712twisted is an event-driven networking engine written in Pyth…7.5
• CVE-2022-21713Grafana is an open-source platform for monitoring and observ…4.3
• CVE-2022-21715CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-st…6.1