{"id":"CVE-2023-28867","details":"In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.","aliases":["GHSA-p4qx-6w5p-4rj2"],"modified":"2026-08-12T13:34:17.661471Z","published":"2023-03-27T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28867.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://github.com/graphql-java/graphql-java/releases/tag/v17.5"},{"type":"WEB","url":"https://github.com/graphql-java/graphql-java/releases/tag/v18.4"},{"type":"WEB","url":"https://github.com/graphql-java/graphql-java/releases/tag/v19.4"},{"type":"WEB","url":"https://github.com/graphql-java/graphql-java/releases/tag/v20.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28867.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28867"},{"type":"FIX","url":"https://github.com/graphql-java/graphql-java/pull/3112"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/graphql-java/graphql-java","events":[{"introduced":"0"},{"fixed":"354bcc355549ef12661d6064ea51a6d4bf20a66c"},{"introduced":"470811bb8bc6864035d7a3795a1a23d6a4952587"},{"fixed":"3e2ccea4c1a41b81ea7c9fd31d7d2dab7e06f8f3"},{"introduced":"35ff68db1e1d567428539d74f2169ca7799ee2a3"},{"fixed":"1f905d8f5a3343da9abe4522fd145de0c319cd4e"},{"introduced":"557ad5dc35338f94fdb973521295be2b6b057625"},{"fixed":"4aedac72787167699dfc3798676c297cb85b79df"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"17.5"},{"introduced":"18.0"},{"fixed":"18.4"},{"introduced":"19.0"},{"fixed":"19.4"},{"introduced":"20.0"},{"last_affected":"20.0"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:graphql-java:graphql-java:*:*:*:*:*:*:*:*","cpe:2.3:a:graphql-java:graphql-java:20.0:*:*:*:*:*:*:*"]}}],"versions":["20.0","v17.4","v18.3","v19.3","v20.0","v19.2","v19.1","v19.0","v17.3","v18.2","v18.1","v18.0","v17.2","v17.0","v17.0.0-beta1","v17.0-beta1","v16.2","v16.1","v16.0","v15.0","v9.7","v14.0","v13.0","v12.0","12.0","v11.0","v10.0","v9.1","v9.0","v8.0","v7.0","v6.0","v5.0","v4.0","v3.0.0","v2.4.0","v2.3.0","v2.2.0","v2.1.0","v2.0.0","v1.3","v1.2","v1.0"],"database_specific":{"vanir_signatures_modified":"2026-08-12T13:34:17Z","vanir_signatures":[{"digest":{"function_hash":"107096461883321427489822662467714116337","length":307},"id":"CVE-2023-28867-1736e906","signature_type":"Function","signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/354bcc355549ef12661d6064ea51a6d4bf20a66c","target":{"file":"src/main/java/graphql/parser/ParserOptions.java","function":"ParserOptions"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"100845729788637426848026172177383082905","length":358},"id":"CVE-2023-28867-19cdfb73","signature_type":"Function","signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/1f905d8f5a3343da9abe4522fd145de0c319cd4e","target":{"file":"src/main/java/graphql/parser/ParserOptions.java","function":"ParserOptions"}},{"source":"https://github.com/graphql-java/graphql-java/commit/1f905d8f5a3343da9abe4522fd145de0c319cd4e","target":{"file":"src/main/java/graphql/parser/Parser.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["39810464262704892563754871815532813521","165316501559607190669458288237610334983","35627563051055791000991564642591742903","85864436817746415041247927113798442401","195441864188803098178798547537929523495","314200291007238960926406327039413550096","2127094700740136968549541663906775223","28942720981026645879105330121937594024","272522729430044705388557687013535291055","172789081020780669056385575504369089135","161592308228573192425130653597497272963","257847696003878904167856234595939976703","141910194616282832636274588007449179038","162422351709377277282648183380178364570","21155586188270923203314999408382070740","309845019958237845687328390800258670777","246411222746214166054943456370084211513","139401985562583892647158600779005865766","98613602508669690155841914830461295674","173929424783329993414352835442163758801","116288404727165704069435834778300964690","181592668769941648756421579526410470597","129219553652390940259631823603094050067","17134766956120441703558036634847004569","39180133892455427899885815116562769428","175491334008586020041722886027116860139","178141823269753667453735617479298620831"]},"id":"CVE-2023-28867-25be4ec1","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"131367469637499662514152788039785718873","length":2029},"id":"CVE-2023-28867-2d314090","signature_type":"Function","signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/1f905d8f5a3343da9abe4522fd145de0c319cd4e","target":{"file":"src/main/java/graphql/parser/Parser.java","function":"parseImpl"}},{"deprecated":false,"digest":{"line_hashes":["167592099264655646664183634937652707679","48061118344386761209421655410361794672","136340033395875762338924714647055543928","98729389709859335548875557707103429431","91416326370818657533111573209263230953","297478578909588886534657724535513718703","13089976929769259490571353488007124246","338427654662022341104417488557457876229","269829574569171290615725279612755665848","4056684683601998069062623756632051213","314612923591991339758976833729365219498","46960125349505788978839297817688662899","72040259244625831823294009055510317505","53862352362822073719081494250115834685","106910668067388805476875303440157788070","276306368489874932668423924759007009769","240520834190533780302424932515378087815","245441175229153445975501379054587156805","54803363921063138440234615057181676309","52354395305982144028806432924491865959","200789073349343591308856415434153339540","4398447980494056475909569226891135570","217492365856953206148280999617600107806","295413907910637757244026578302808421445","99347107812727345644276340698356893253","243639786114660059227904537263337804371","184082509827344320816882284096978071451","301145714464474871332206555035731958165","8097071380394560178713026838585149735","132747338018992063484214645278964739591","111389838724433899831384020036264643244","61616143660020220903382064222456939397","251416392363188586572221146763484883503","68216252802730252774750438877243389761","37953200468002735639786874651527888578","48641215820760846429003416729981659780","209729894160092830063855389200447221609","60267308480124250787641142868099678146","207467004336133005305202410574630972797","194478939411198217990743902055704865779","91331019333138453130832968113321001402","152017923807475988241759782297419553919","335670201368948803720098520808311088959"],"threshold":0.9},"id":"CVE-2023-28867-2e215ef5","signature_type":"Line","signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/3e2ccea4c1a41b81ea7c9fd31d7d2dab7e06f8f3","target":{"file":"src/main/java/graphql/parser/ParserOptions.java"}},{"source":"https://github.com/graphql-java/graphql-java/commit/3e2ccea4c1a41b81ea7c9fd31d7d2dab7e06f8f3","target":{"file":"src/main/java/graphql/parser/Parser.java"},"deprecated":false,"digest":{"line_hashes":["39810464262704892563754871815532813521","165316501559607190669458288237610334983","35627563051055791000991564642591742903","85864436817746415041247927113798442401","195441864188803098178798547537929523495","314200291007238960926406327039413550096","2127094700740136968549541663906775223","28942720981026645879105330121937594024","272522729430044705388557687013535291055","172789081020780669056385575504369089135","161592308228573192425130653597497272963","257847696003878904167856234595939976703","141910194616282832636274588007449179038","162422351709377277282648183380178364570","21155586188270923203314999408382070740","309845019958237845687328390800258670777","246411222746214166054943456370084211513","139401985562583892647158600779005865766","98613602508669690155841914830461295674","173929424783329993414352835442163758801","116288404727165704069435834778300964690","181592668769941648756421579526410470597","129219553652390940259631823603094050067","17134766956120441703558036634847004569","39180133892455427899885815116562769428","175491334008586020041722886027116860139","178141823269753667453735617479298620831"],"threshold":0.9},"id":"CVE-2023-28867-636d5477","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"131367469637499662514152788039785718873","length":2029},"id":"CVE-2023-28867-6751c519","signature_type":"Function","signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/3e2ccea4c1a41b81ea7c9fd31d7d2dab7e06f8f3","target":{"file":"src/main/java/graphql/parser/Parser.java","function":"parseImpl"}},{"source":"https://github.com/graphql-java/graphql-java/commit/354bcc355549ef12661d6064ea51a6d4bf20a66c","target":{"file":"src/main/java/graphql/parser/Parser.java","function":"parseImpl"},"deprecated":false,"digest":{"function_hash":"131367469637499662514152788039785718873","length":2029},"id":"CVE-2023-28867-7a240710","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/graphql-java/graphql-java/commit/354bcc355549ef12661d6064ea51a6d4bf20a66c","target":{"function":"Builder","file":"src/main/java/graphql/parser/ParserOptions.java"},"deprecated":false,"digest":{"function_hash":"107096461883321427489822662467714116337","length":307},"id":"CVE-2023-28867-84706de9","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"261722846679163255346022045269518140061","length":622},"id":"CVE-2023-28867-931b3bbd","signature_type":"Function","signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/3e2ccea4c1a41b81ea7c9fd31d7d2dab7e06f8f3","target":{"file":"src/main/java/graphql/parser/Parser.java","function":"throwCancelParseIfTooManyTokens"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/1f905d8f5a3343da9abe4522fd145de0c319cd4e","target":{"file":"src/main/java/graphql/parser/Parser.java","function":"throwCancelParseIfTooManyTokens"},"deprecated":false,"digest":{"function_hash":"261722846679163255346022045269518140061","length":622},"id":"CVE-2023-28867-99162a76"},{"deprecated":false,"digest":{"function_hash":"98977058209400896274451248014768637340","length":160},"id":"CVE-2023-28867-9f342fad","signature_type":"Function","signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/354bcc355549ef12661d6064ea51a6d4bf20a66c","target":{"file":"src/main/java/graphql/parser/Parser.java","function":"visitTerminal"}},{"signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/354bcc355549ef12661d6064ea51a6d4bf20a66c","target":{"file":"src/main/java/graphql/parser/ParserOptions.java"},"deprecated":false,"digest":{"line_hashes":["167592099264655646664183634937652707679","48061118344386761209421655410361794672","136340033395875762338924714647055543928","98729389709859335548875557707103429431","91416326370818657533111573209263230953","297478578909588886534657724535513718703","13089976929769259490571353488007124246","338427654662022341104417488557457876229","269829574569171290615725279612755665848","4056684683601998069062623756632051213","314612923591991339758976833729365219498","46960125349505788978839297817688662899","72040259244625831823294009055510317505","53862352362822073719081494250115834685","106910668067388805476875303440157788070","276306368489874932668423924759007009769","240520834190533780302424932515378087815","245441175229153445975501379054587156805","54803363921063138440234615057181676309","52354395305982144028806432924491865959","102946193542560119040145842864590979970","81585618443658454952416335334008094176","220566234918611789025807121263669223294","295413907910637757244026578302808421445","190457606341830965153789775001315195676","228605203546321115621511159325076890431","159542464739293998820090389534722265909","139773028368889587784590594558186088375","59075709276663536790541152776342721535","70151371328435594289928652107717301375","56761871629815201096650662931670150612","75681159018350375153611959441500337195","235641403697900720502578085434185703743","48641215820760846429003416729981659780","209729894160092830063855389200447221609","311015808044674598272751413641469290572","9031673614721156524331266755228237343","159770413061440102796656992905069860065","23686616431714611868553961585639452181","19360163883863100654519157062032647181","276726009393873248976542950838164435372"],"threshold":0.9},"id":"CVE-2023-28867-a82fa07d","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"261722846679163255346022045269518140061","length":622},"id":"CVE-2023-28867-a9e6c66d","signature_type":"Function","signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/354bcc355549ef12661d6064ea51a6d4bf20a66c","target":{"file":"src/main/java/graphql/parser/Parser.java","function":"throwCancelParseIfTooManyTokens"}},{"source":"https://github.com/graphql-java/graphql-java/commit/3e2ccea4c1a41b81ea7c9fd31d7d2dab7e06f8f3","target":{"file":"src/main/java/graphql/parser/ParserOptions.java","function":"Builder"},"deprecated":false,"digest":{"function_hash":"100845729788637426848026172177383082905","length":358},"id":"CVE-2023-28867-ad70dde2","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"100845729788637426848026172177383082905","length":358},"id":"CVE-2023-28867-aecd18e6","signature_type":"Function","signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/1f905d8f5a3343da9abe4522fd145de0c319cd4e","target":{"function":"Builder","file":"src/main/java/graphql/parser/ParserOptions.java"}},{"signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/1f905d8f5a3343da9abe4522fd145de0c319cd4e","target":{"file":"src/main/java/graphql/parser/Parser.java","function":"setupParserListener"},"deprecated":false,"digest":{"function_hash":"283419530021468244310602323395699962217","length":791},"id":"CVE-2023-28867-afbc220a","signature_type":"Function"},{"id":"CVE-2023-28867-bc4f4135","signature_type":"Function","signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/1f905d8f5a3343da9abe4522fd145de0c319cd4e","target":{"file":"src/main/java/graphql/parser/Parser.java","function":"visitTerminal"},"deprecated":false,"digest":{"length":522,"function_hash":"192187236361422592697581414175043895792"}},{"digest":{"function_hash":"100845729788637426848026172177383082905","length":358},"id":"CVE-2023-28867-bf473cba","signature_type":"Function","signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/3e2ccea4c1a41b81ea7c9fd31d7d2dab7e06f8f3","target":{"function":"ParserOptions","file":"src/main/java/graphql/parser/ParserOptions.java"},"deprecated":false},{"id":"CVE-2023-28867-c1c02d99","signature_type":"Line","signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/354bcc355549ef12661d6064ea51a6d4bf20a66c","target":{"file":"src/main/java/graphql/parser/Parser.java"},"deprecated":false,"digest":{"line_hashes":["39810464262704892563754871815532813521","165316501559607190669458288237610334983","35627563051055791000991564642591742903","85864436817746415041247927113798442401","322491364238379011668677832620288792409","286606710324992052697418163595418380338","234363346061103890360923069537510902923","149538038130569568411482220888772796758","272522729430044705388557687013535291055","183334901620001236037653991993493545455","211380834177819331184568884267377441686","223876146626007495419016266676682051009","63408308177239304964395097383326721615","257847696003878904167856234595939976703","141910194616282832636274588007449179038","162422351709377277282648183380178364570","21155586188270923203314999408382070740","309845019958237845687328390800258670777","246411222746214166054943456370084211513","139401985562583892647158600779005865766","98613602508669690155841914830461295674","173929424783329993414352835442163758801","116288404727165704069435834778300964690","181592668769941648756421579526410470597","129219553652390940259631823603094050067","17134766956120441703558036634847004569","39180133892455427899885815116562769428","175491334008586020041722886027116860139","178141823269753667453735617479298620831"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/3e2ccea4c1a41b81ea7c9fd31d7d2dab7e06f8f3","target":{"file":"src/main/java/graphql/parser/Parser.java","function":"setupParserListener"},"deprecated":false,"digest":{"length":791,"function_hash":"283419530021468244310602323395699962217"},"id":"CVE-2023-28867-e442f89c"},{"source":"https://github.com/graphql-java/graphql-java/commit/1f905d8f5a3343da9abe4522fd145de0c319cd4e","target":{"file":"src/main/java/graphql/parser/ParserOptions.java"},"deprecated":false,"digest":{"line_hashes":["167592099264655646664183634937652707679","48061118344386761209421655410361794672","136340033395875762338924714647055543928","98729389709859335548875557707103429431","91416326370818657533111573209263230953","297478578909588886534657724535513718703","13089976929769259490571353488007124246","338427654662022341104417488557457876229","269829574569171290615725279612755665848","4056684683601998069062623756632051213","314612923591991339758976833729365219498","46960125349505788978839297817688662899","72040259244625831823294009055510317505","53862352362822073719081494250115834685","106910668067388805476875303440157788070","276306368489874932668423924759007009769","240520834190533780302424932515378087815","245441175229153445975501379054587156805","54803363921063138440234615057181676309","52354395305982144028806432924491865959","200789073349343591308856415434153339540","4398447980494056475909569226891135570","217492365856953206148280999617600107806","295413907910637757244026578302808421445","99347107812727345644276340698356893253","243639786114660059227904537263337804371","184082509827344320816882284096978071451","301145714464474871332206555035731958165","8097071380394560178713026838585149735","132747338018992063484214645278964739591","111389838724433899831384020036264643244","61616143660020220903382064222456939397","251416392363188586572221146763484883503","68216252802730252774750438877243389761","37953200468002735639786874651527888578","48641215820760846429003416729981659780","209729894160092830063855389200447221609","60267308480124250787641142868099678146","207467004336133005305202410574630972797","194478939411198217990743902055704865779","91331019333138453130832968113321001402","152017923807475988241759782297419553919","335670201368948803720098520808311088959"],"threshold":0.9},"id":"CVE-2023-28867-f088709c","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/3e2ccea4c1a41b81ea7c9fd31d7d2dab7e06f8f3","target":{"file":"src/main/java/graphql/parser/Parser.java","function":"visitTerminal"},"deprecated":false,"digest":{"function_hash":"192187236361422592697581414175043895792","length":522},"id":"CVE-2023-28867-f3169add"},{"target":{"file":"src/main/java/graphql/parser/Parser.java","function":"setupParserListener"},"deprecated":false,"digest":{"function_hash":"58632047594417232813919698799212504335","length":385},"id":"CVE-2023-28867-f779ed6b","signature_type":"Function","signature_version":"v1","source":"https://github.com/graphql-java/graphql-java/commit/354bcc355549ef12661d6064ea51a6d4bf20a66c"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-28867.json"}}],"schema_version":"1.9.0"}