Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
known workarounds for this issue exist. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/specklesystems/speckle-server/security/advisories/GHSA-xpf3-5q5x-3qwh - https://github.com/specklesystems/speckle-server/commit/3689e1cd58ec4f06abee836af34889d6ce474571 - https://github.com/specklesystems/speckle-server/releases/tag/2.17.6
CVE ID: CVE-2023-50714 State: PUBLISHED Published: 2023-12-22T18:30:03.118Z Last Updated: 2024-11-27T15:43:11.763Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: yiisoft Products: yii2-authclient Problem Types: CWE-918, CWE-347 Description: yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be removed after usage (similar to `authState`). Second, there is a risk for a `downgrade attack` if PKCE is being relied on for CSRF protection. Version 2.2.15 contai
. Second, there is a risk for a `downgrade attack` if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-rw54-6826-c8j5 - https://github.com/yiisoft/yii2-authclient/commit/721ed974bc44137437b0cdc8454e137fff8db213 - https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158 - https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121 - https://github.com/yiisoft/y
yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121 - https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420
CVE ID: CVE-2023-50715 State: PUBLISHED Published: 2023-12-15T02:05:57.580Z Last Updated: 2024-08-02T22:16:47.325Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: home-assistant Products: core Problem Types: CWE-200 Description: Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. Version 2023.12.3 contains a patch for this issue. When starting the Home Assistant 2023.12 release, the login page returns all currently active user accounts to browsing requests from the Local Area Network. Tests showed th
login page returns all currently active user accounts to browsing requests from the Local Area Network. Tests showed that this occurs when the request is not authenticated and the request originated locally, meaning on the Home Assistant host local subnet or any other private subnet. The rationale behind this is to make the login more user-friendly and an experience better aligned with other applications that have multiple user-profiles. However, as a result, all accounts are displayed regardless of them having logged in or not and for any device that navigates to the server. This disclosure is mitigated by the fact that it only occurs for requests originating from a LAN address. But note t
er. This disclosure is mitigated by the fact that it only occurs for requests originating from a LAN address. But note that this applies to the local subnet where Home Assistant resides and to any private subnet that can reach it. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/home-assistant/core/security/advisories/GHSA-jqpc-rc7g-vf83 - https://github.com/home-assistant/core/commit/dbfc5ea8f96bde6cd165892f5a6a6f9a65731c76
CVE ID: CVE-2023-50716 State: PUBLISHED Published: 2024-03-06T17:23:55.916Z Last Updated: 2024-08-02T22:16:47.221Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: eProsima Products: Fast-DDS Problem Types: CWE-416 Description: eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.13.0, 2.12.2, 2.11.3, 2.10.3, and 2.6.7, an invalid DATA_FRAG Submessage causes a bad-free error, and the Fast-DDS process can be remotely terminated. If an invalid Data_Frag packet is sent, the `Inline_qos, SerializedPayload` member of object `ch` will attempt to release memory
alid Data_Frag packet is sent, the `Inline_qos, SerializedPayload` member of object `ch` will attempt to release memory without initialization, resulting in a 'bad-free' error. Versions 2.13.0, 2.12.2, 2.11.3, 2.10.2, and 2.6.7 fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-5m2f-hvj2-cx2h
CVE ID: CVE-2023-50717 State: PUBLISHED Published: 2024-05-13T16:05:48.148Z Last Updated: 2024-08-02T22:16:47.335Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: nocodb Products: nocodb Problem Types: CWE-434, CWE-79 Description: NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading stored cross-site scripting attack. This allows remote attacker to execute JavaScript code in the context of the user accessing the vector. An attacker could have used this v
attacker to execute JavaScript code in the context of the user accessing the vector. An attacker could have used this vulnerability to execute requests in the name of a logged-in user or potentially collect information about the attacked user by displaying a malicious form. Version 0.202.10 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/nocodb/nocodb/security/advisories/GHSA-qg73-g3cf-vhhh
CVE ID: CVE-2023-50718 State: PUBLISHED Published: 2024-05-13T16:08:09.198Z Last Updated: 2024-08-21T20:46:16.025Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: nocodb Products: nocodb Problem Types: CWE-89 Description: NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped `table_name`. This vulnerability may result in leakage of sensitive data in the database. Version 0.202.10 contains a patch for the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/
the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8
CVE ID: CVE-2023-50719 State: PUBLISHED Published: 2023-12-15T19:02:40.905Z Last Updated: 2024-10-08T14:15:20.992Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-359, CWE-200 Description: XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. This vulnerability also affects any configurations used by extensions that contain passwords like API keys that are viewable for
nerability also affects any configurations used by extensions that contain passwords like API keys that are viewable for the attacker. Normally, such passwords aren't accessible but this vulnerability would disclose them as plain text. This has been patched in XWiki 14.10.15, 15.5.2 and 15.7RC1. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p6cp-6r35-32mh - https://github.com/xwiki/xwiki-platform/commit/3e5272f2ef0dff06a8f4db10afd1949b2f9e6eea - https://jira.xwiki.org/browse/XWIKI-21208
CVE ID: CVE-2023-50720 State: PUBLISHED Published: 2023-12-15T19:02:35.372Z Last Updated: 2024-08-02T22:16:47.165Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-200 Description: XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for `objcontent:email*` using XWiki's regular search interface. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1 by not indexing email address properties when obfuscatio
face. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1 by not indexing email address properties when obfuscation is enabled. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2grh-gr37-2283 - https://github.com/xwiki/xwiki-platform/commit/3e5272f2ef0dff06a8f4db10afd1949b2f9e6eea - https://jira.xwiki.org/browse/XWIKI-20371
CVE ID: CVE-2023-50721 State: PUBLISHED Published: 2023-12-15T19:02:46.076Z Last Updated: 2024-08-02T22:16:47.207Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-95, CWE-94 Description: XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface doesn't properly escape the id and label of search user interface extensions, allowing the injection of XWiki syntax containing script macros including Groovy macros that allow remote code execution, impacting the confidentiality, integrity and availability of the whole XW
roovy macros that allow remote code execution, impacting the confidentiality, integrity and availability of the whole XWiki instance. This attack can be executed by any user who can edit some wiki page like the user's profile (editable by default) as user interface extensions that will be displayed in the search administration can be added on any document by any user. The necessary escaping has been added in XWiki 14.10.15, 15.5.2 and 15.7RC1. As a workaround, the patch can be applied manually applied to the page `XWiki.SearchAdmin`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7654-vfh6-rw6x - https://githu
Container: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7654-vfh6-rw6x - https://github.com/xwiki/xwiki-platform/commit/62863736d78ffd60d822279c5fb7fb9593042766 - https://jira.xwiki.org/browse/XWIKI-21200
CVE ID: CVE-2023-50722 State: PUBLISHED Published: 2023-12-15T19:02:52.134Z Last Updated: 2024-08-02T22:16:47.397Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-79, CWE-352 Description: XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, there is a reflected XSS or also direct remote code execution vulnerability in the code for displaying configurable admin sections. The code that can be passed through a URL parameter is only executed when the user who is visiting the crafted URL has edit right on at least one configuration section. While any u
executed when the user who is visiting the crafted URL has edit right on at least one configuration section. While any user of the wiki could easily create such a section, this vulnerability doesn't require the attacker to have an account or any access on the wiki. It is sufficient to trick any admin user of the XWiki installation to visit the crafted URL. This vulnerability allows full remote code execution with programming rights and thus impacts the confidentiality, integrity and availability of the whole XWiki installation. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1. The patch can be manually applied to the document `XWiki.ConfigurableClass`. Additional Analyst Notes: - CV
and 15.7RC1. The patch can be manually applied to the document `XWiki.ConfigurableClass`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cp3j-273x-3jxc - https://github.com/xwiki/xwiki-platform/commit/5e14c8d08fd0c5b619833d35090b470aa4cb52b0 - https://jira.xwiki.org/browse/XWIKI-21167
CVE ID: CVE-2023-50723 State: PUBLISHED Published: 2023-12-15T19:02:57.939Z Last Updated: 2025-05-07T20:43:16.451Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-95, CWE-94 Description: XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, anyone who can edit an arbitrary wiki page in an XWiki installation can gain programming right through several cases of missing escaping in the code for displaying sections in the administration interface. This impacts the confidentiality, integrity and availability of the whole XWiki installation. Normally, all
interface. This impacts the confidentiality, integrity and availability of the whole XWiki installation. Normally, all users are allowed to edit their own user profile so this should be exploitable by all users of the XWiki instance. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1. The patches can be manually applied to the `XWiki.ConfigurableClassMacros` and `XWiki.ConfigurableClass` pages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qj86-p74r-7wp5 - https://github.com/xwiki/xwiki-platform/commit/0f367aaae4e0696f61cf5a67a75edd27d1d16db6 - https://github.com/xwiki/xwiki-p
tps://github.com/xwiki/xwiki-platform/commit/0f367aaae4e0696f61cf5a67a75edd27d1d16db6 - https://github.com/xwiki/xwiki-platform/commit/1157c1ecea395aac7f64cd8a6f484b1225416dc7 - https://github.com/xwiki/xwiki-platform/commit/749f6aee1bfbcf191c3734ea0aa9eba3aa63240e - https://github.com/xwiki/xwiki-platform/commit/bd82be936c21b65dee367d558e3050b9b6995713 - https://jira.xwiki.org/browse/XWIKI-21121 - https://jira.xwiki.org/browse/XWIKI-21122 - https://jira.xwiki.org/browse/XWIKI-21194
CVE ID: CVE-2023-50724 State: PUBLISHED Published: 2023-12-21T14:50:29.294Z Last Updated: 2024-08-27T15:02:43.928Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: resque Products: resque Problem Types: CWE-79 Description: Resque (pronounced like "rescue") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint. This issue has been patched in version 2.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https
atched in version 2.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj - https://github.com/resque/resque/issues/1679 - https://github.com/resque/resque/pull/1687
CVE ID: CVE-2023-50725 State: PUBLISHED Published: 2023-12-22T20:02:15.568Z Last Updated: 2024-08-02T22:16:47.164Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: resque Products: resque Problem Types: CWE-79 Description: Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: "/failed/?class=<script>alert(document.cookie)</script>" and "/queues/><img src=a onerror=alert(document.cookie)>". This issue has been patched in version 2.2.1. Additional Analyst Notes: - CVE Program Container: References: - http
)>". This issue has been patched in version 2.2.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/resque/resque/security/advisories/GHSA-gc3j-vvwf-4rp8 - https://github.com/resque/resque/pull/1790 - https://github.com/resque/resque/commit/ee99d2ed6cc75d9d384483b70c2d96d312115f07 - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/resque/CVE-2023-50725.yml
CVE ID: CVE-2023-50726 State: PUBLISHED Published: 2024-03-13T20:50:52.245Z Last Updated: 2025-04-15T15:17:37.225Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L) Vendors: argoproj Products: argo-cd Problem Types: CWE-269 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git. An improper validation bug allows users who have `create` privileges but not `override`
s any merge protections in git. An improper validation bug allows users who have `create` privileges but not `override` privileges to sync local manifests on app creation. All other restrictions, including AppProject restrictions are still enforced. The only restriction which is not enforced is that the manifests come from some approved git/Helm/OCI source. The bug was introduced in 1.2.0-rc1 when the local manifest sync feature was added. The bug has been patched in Argo CD versions 2.10.3, 2.9.8, and 2.8.12. Users are advised to upgrade. Users unable to upgrade may mitigate the risk of branch protection bypass by removing `applications, create` RBAC access. The only way to eliminate the is
te the risk of branch protection bypass by removing `applications, create` RBAC access. The only way to eliminate the issue without removing RBAC access is to upgrade to a patched version. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-g623-jcgg-mhmm - https://github.com/argoproj/argo-cd/commit/3b8f673f06c2d228e01cbc830e5cb57cef008978 - https://argo-cd.readthedocs.io/en/latest/operator-manual/rbac
CVE ID: CVE-2023-50727 State: PUBLISHED Published: 2023-12-22T20:10:10.964Z Last Updated: 2025-04-23T16:17:49.438Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: resque Products: resque Problem Types: CWE-79 Description: Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /"><svg%20onload=alert(domain)>. This issue has been patched in version 2.6.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g - https://github.
P Vulnrichment: References: - https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g - https://github.com/resque/resque/pull/1865 - https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a
CVE ID: CVE-2023-50728 State: PUBLISHED Published: 2023-12-15T21:59:00.312Z Last Updated: 2024-08-02T22:16:47.284Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: octokit Products: webhooks.js Problem Types: CWE-755 Description: octokit/webhooks is a GitHub webhook events toolset for Node.js. Starting in 9.26.0 and prior to 9.26.3, 10.9.2, 11.1.2, and 12.0.4, there is a problem caused by an issue with error handling in the @octokit/webhooks library because the error can be undefined in some cases. The resulting request was found to cause an uncaught exception that ends the nodejs process. The bug is fixed in octokit/webhooks.js 9.26.3, 10.9.2, 11.1.2, and 12
uncaught exception that ends the nodejs process. The bug is fixed in octokit/webhooks.js 9.26.3, 10.9.2, 11.1.2, and 12.0.4, app.js 14.02, octokit.js 3.1.2, and Protobot 12.3.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octokit/webhooks.js/security/advisories/GHSA-pwfr-8pq7-x9qv - https://github.com/octokit/app.js/releases/tag/v14.0.2 - https://github.com/octokit/octokit.js/releases/tag/v3.1.2 - https://github.com/octokit/webhooks.js/releases/tag/v10.9.2 - https://github.com/octokit/webhooks.js/releases/tag/v11.1.2 - https://github.com/octokit/webhooks.js/releases/tag/v12.0.4 - https://github.com/octokit/webhooks.js/releases/tag/v9.26.3 - https://gi
.com/octokit/webhooks.js/releases/tag/v12.0.4 - https://github.com/octokit/webhooks.js/releases/tag/v9.26.3 - https://github.com/probot/probot/releases/tag/v12.3.3
CVE ID: CVE-2023-50729 State: PUBLISHED Published: 2024-01-15T15:57:27.575Z Last Updated: 2025-06-17T21:09:23.046Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: traccar Products: traccar Problem Types: CWE-434 Description: Traccar is an open source GPS tracking system. Prior to 5.11, Traccar is affected by an unrestricted file upload vulnerability in File feature allows attackers to execute arbitrary code on the server. This vulnerability is more prevalent because Traccar is recommended to run web servers as root user. It is also more dangerous because it can write or overwrite files in arbitrary locations. Version 5.11 was published to fix this vulnerabilit
rous because it can write or overwrite files in arbitrary locations. Version 5.11 was published to fix this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/traccar/traccar/security/advisories/GHSA-pqf7-8g85-vx2q
CVE ID: CVE-2023-50730 State: PUBLISHED Published: 2023-12-22T20:36:11.402Z Last Updated: 2024-08-02T22:16:47.266Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: typelevel Products: grackle Problem Types: CWE-400, CWE-770 Description: Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragments must not form cycles, either directly or indirectly. Prior to Grackle version 0.18.0, that requirement wasn't checked, and queries with cyclic fragments would have been accepted for type checking and compilation. The attempted compilation of such fragments would result in a JVM `StackOv
n accepted for type checking and compilation. The attempted compilation of such fragments would result in a JVM `StackOverflowError` being thrown. Some knowledge of an applications GraphQL schema would be required to construct such a query, however no knowledge of any application-specific performance or other behavioural characteristics would be needed. Grackle uses the cats-parse library for parsing GraphQL queries. Prior to version 0.18.0, Grackle made use of the cats-parse `recursive` operator. However, `recursive` is not currently stack safe. `recursive` was used in three places in the parser: nested selection sets, nested input values (lists and objects), and nested list type declaratio
ee places in the parser: nested selection sets, nested input values (lists and objects), and nested list type declarations. Consequently, queries with deeply nested selection sets, input values or list types could be constructed which exploited this, causing a JVM `StackOverflowException` to be thrown during parsing. Because this happens very early in query processing, no specific knowledge of an applications GraphQL schema would be required to construct such a query. The possibility of small queries resulting in stack overflow is a potential denial of service vulnerability. This potentially affects all applications using Grackle which have untrusted users. Both stack overflow issues have be