HarborGuard / CVE
Back to search
HIGHCVE-2026-33756Published Modified CNA GitHub_M

CVE-2026-33756: Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching

Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL operations in a single HTTP request as a JSON array but wasn't enforcing any upper limit on the number of operations. This allowed an unauthenticated attacker to send a single HTTP request many operations (bypassing the per query complexity limit) to exhaust resources. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

Metrics

CVSS v3.1
7.5
Severity
HIGH
Fixed in
—
Affected Products
1
Affected packages
  • saleor / saleor
    >= 2.0.0, < 3.20.118 · >= 3.21.0-a.0, < 3.21.54 · >= 3.22.0-a.0, < 3.22.47 · >= 3.23.0-a.0, < 3.23.0a3
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References