{"id":"EUVD-2022-6229","enisaUuid":"6fa7e4ae-acbe-3561-ba84-e476f58b2484","description":"Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue has been addressed in version 0.15.10. Users are advised to upgrade. Users unable to upgrade should limit the recursion depth manually.","datePublished":"Aug 1, 2022, 6:50:12 PM","dateUpdated":"Apr 22, 2025, 5:46:34 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/graphql-rust/juniper/security/advisories/GHSA-4rx6-g5vg-5f3j\nhttps://github.com/graphql-rust/juniper/commit/2b609ee057be950e3454b69fadc431d120e407bb\nhttps://github.com/graphql-rust/juniper/commit/8d28cdba6eb10f53490ba41d1b5cb40506c2de22\nhttps://github.com/graphql-rust/juniper/blob/juniper-v0.15.10/juniper/CHANGELOG.md#01510-2022-07-28\n","aliases":"CVE-2022-31173\nGHSA-4rx6-g5vg-5f3j\n","assigner":"GitHub_M","epss":1.72,"enisaIdProduct":[{"id":"6eea4e2f-4243-369b-b767-4aa693c5b24d","product":{"name":"juniper","vendor":{"name":"graphql-rust"}},"product_version":"\u003c 0.15.10"}],"enisaIdVendor":[{"id":"7636643f-877b-3ac6-ae72-73e7c527973c","vendor":{"name":"graphql-rust"}}],"enisaIdVulnerability":[{"id":"5458f246-aced-3375-b829-081194382836","vulnerability":{"id":"CVE-2022-31173","description":"Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue has been addressed in version 0.15.10. Users are advised to upgrade. Users unable to upgrade should limit the recursion depth manually.","datePublished":"Aug 1, 2022, 6:50:12 PM","dateUpdated":"Apr 22, 2025, 5:46:34 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/graphql-rust/juniper/security/advisories/GHSA-4rx6-g5vg-5f3j\nhttps://github.com/graphql-rust/juniper/commit/2b609ee057be950e3454b69fadc431d120e407bb\nhttps://github.com/graphql-rust/juniper/commit/8d28cdba6eb10f53490ba41d1b5cb40506c2de22\nhttps://github.com/graphql-rust/juniper/blob/juniper-v0.15.10/juniper/CHANGELOG.md#01510-2022-07-28\n","enisa_id":"EUVD-2022-6229\n","assigner":"GitHub_M","epss":1.72,"dataProcessed":"Oct 30, 2026, 7:20:33 AM","vulnerabilityProduct":[{"id":"48b4e0aa-01a9-469e-8a30-1336df4a8a98","product":{"name":"juniper","vendor":{"name":"graphql-rust"}},"product_version":"\u003c 0.15.10"},{"id":"4de11091-3615-3329-942f-8a9efc4a28de","product":{"name":"juniper","vendor":{"name":"graphql-rust"}},"product_version":"\u003c 0.15.10"}],"vulnerabilityVendor":[{"id":"544ba0fc-f6b1-3732-919c-eb88f13f0a4b","vendor":{"name":"graphql-rust"}}]}},{"id":"95ee2102-c932-3845-8b62-c3a07d9f8997","vulnerability":{"id":"GHSA-4rx6-g5vg-5f3j","description":"Juniper is vulnerable to @DOS GraphQL Nested Fragments overflow","datePublished":"Jul 29, 2022, 10:29:22 PM","dateUpdated":"Jul 29, 2022, 10:29:22 PM","baseScore":null,"references":"https://github.com/graphql-rust/juniper/security/advisories/GHSA-4rx6-g5vg-5f3j\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-31173\nhttps://github.com/graphql-rust/juniper/commit/2b609ee057be950e3454b69fadc431d120e407bb\nhttps://github.com/graphql-rust/juniper/commit/8d28cdba6eb10f53490ba41d1b5cb40506c2de22\nhttps://github.com/graphql-rust/juniper\nhttps://github.com/graphql-rust/juniper/blob/juniper-v0.15.10/juniper/CHANGELOG.md#01510-2022-07-28\nhttps://rustsec.org/advisories/RUSTSEC-2022-0038.html\n","enisa_id":"EUVD-2022-6229\n","aliases":"GHSA-4rx6-g5vg-5f3j\nCVE-2022-31173\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:05:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}