Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2022-37734: graphql-java can be overloaded by crafted query
CVE-2022-37734 · published 4 years ago
Summary
The graphql-java library versions before 19.0 can be forced to use excessive CPU when it receives a specially crafted GraphQL request. This can slow down or stop the service that relies on the library. Update to version 19.0 or later (or 18.3, 17.4, or the specific 2022‑07‑26 build) to prevent the issue.
What to do
- Update graphql-java com.graphql-java:graphql-java to version 17.4.
- Update graphql-java com.graphql-java:graphql-java to version 18.3.
- Update com.graphql-java:graphql-java to version 16.2-aikido.1.
- Update io.root.com.graphql-java:graphql-java to version 16.2-root.io.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | graphql-java | com.graphql-java:graphql-java |
< 17.4 >= 18.0, < 18.3 Fix: upgrade to 17.4
|
| – | graphql-java_project | graphql-java |
< 17.4 >= 18.0, < 18.3 cpe:2.3:a:graphql-java_project:graphql-java:*:*:*:*:*:java:*:* |
| Root:Maven | – | com.graphql-java:graphql-java |
< 16.2-aikido.1 Fix: upgrade to 16.2-aikido.1
|
| Root:Maven | – | io.root.com.graphql-java:graphql-java |
< 16.2-root.io.1 Fix: upgrade to 16.2-root.io.1
|
Original advisory text
CVE-2022-37734 in com.graphql-java:graphql-java - Patched by Root
graphql-java before19.0 is vulnerable to Denial of Service. An attacker can send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0 and later, 18.3, and 17.4, and 0.0.0-2022-07-26T05-45-04-226aabd9.
References
- https://security.snyk.io/vuln/SNYK-JAVA-COMGRAPHQLJAVA-3021519
- https://github.com/advisories/GHSA-v62j-cxhh-fq22
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37734... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-37734 Vendor Advisory
- https://github.com/graphql-java/graphql-java/discussions/2958 URL
- https://github.com/graphql-java/graphql-java/issues/2888 Third Party Advisory
- https://github.com/graphql-java/graphql-java/pull/2892 Patch
- https://github.com/graphql-java/graphql-java/releases Product
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published12 Sep 2022
Updated29 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta