CVE-2022-31173

Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue has been addressed in version 0.15.10. Users are advised to upgrade. Users unable to upgrade should limit the recursion depth manually.

• CWE-400
• CWE-674

• https://github.com/graphql-rust/juniper/blob/juniper-v0.15.10/juniper/CHANGELOG.md#01510-2022-07-28Release Notes, Third Party Advisory
• https://github.com/graphql-rust/juniper/commit/2b609ee057be950e3454b69fadc431d120e407bbPatch, Third Party Advisory
• https://github.com/graphql-rust/juniper/commit/8d28cdba6eb10f53490ba41d1b5cb40506c2de22Patch, Third Party Advisory
• https://github.com/graphql-rust/juniper/security/advisories/GHSA-4rx6-g5vg-5f3jExploit, Third Party Advisory
• https://github.com/graphql-rust/juniper/blob/juniper-v0.15.10/juniper/CHANGELOG.md#01510-2022-07-28Release Notes, Third Party Advisory
• https://github.com/graphql-rust/juniper/commit/2b609ee057be950e3454b69fadc431d120e407bbPatch, Third Party Advisory
• https://github.com/graphql-rust/juniper/commit/8d28cdba6eb10f53490ba41d1b5cb40506c2de22Patch, Third Party Advisory
• https://github.com/graphql-rust/juniper/security/advisories/GHSA-4rx6-g5vg-5f3jExploit, Third Party Advisory

Published

Aug 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31168Zulip is an open source team chat tool. Due to an incorrect …8.8
• CVE-2022-31169Wasmtime is a standalone runtime for WebAssembly. There is a…7.5
• CVE-2022-3117Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-31170OpenZeppelin Contracts is a library for smart contract devel…7.5
• CVE-2022-31171Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-31172OpenZeppelin Contracts is a library for smart contract devel…7.5
• CVE-2022-31175CKEditor 5 is a JavaScript rich text editor. A cross-site sc…4.7
• CVE-2022-31176Grafana Image Renderer is a Grafana backend plugin that hand…8.1
• CVE-2022-31177Flask-AppBuilder is an application development framework bui…2.7
• CVE-2022-31178eLabFTW is an electronic lab notebook manager for research t…4.3
• CVE-2022-31179Shescape is a simple shell escape package for JavaScript. Ve…9.8
• CVE-2022-3118A vulnerability was found in Sourcecodehero ERP System Proje…9.8