Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:gem/graphql@2.4.18
purl pkg:gem/graphql@2.4.18
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-u1pb-z884-8fby GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens GraphQL-Ruby's `max_query_string_tokens` configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached. In patched versions, the Ruby lexer does count these tokens. GraphQL-CParser is not affected by this problem. `max_query_string_tokens` was introduced in v2.3.1. Each 2.x version has received a new patch release for including a fix. GHSA-3h96-34p3-xm76

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-13T06:29:54.889317+00:00 GHSA Importer Fixing VCID-u1pb-z884-8fby https://github.com/advisories/GHSA-3h96-34p3-xm76 38.6.0
2026-06-12T22:21:16.068723+00:00 GitLab Importer Fixing VCID-u1pb-z884-8fby https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/graphql/GHSA-3h96-34p3-xm76.yml 38.6.0
2026-06-12T07:51:21.659742+00:00 GithubOSV Importer Fixing VCID-u1pb-z884-8fby https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-3h96-34p3-xm76/GHSA-3h96-34p3-xm76.json 38.6.0