VulnerableCode Package Details - pkg:maven/com.graphql-java/graphql-java@17.4

Search for packages

Vulnerability	Summary	Fixed by
VCID-5z1v-pkb5-d7e7 Aliases: CVE-2024-40094 GHSA-h9mq-f6q5-6c8m	GraphQL Java does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.	19.11 Affected by 0 other vulnerabilities. 20.9 Affected by 0 other vulnerabilities. 21.5 Affected by 0 other vulnerabilities.
VCID-gwdw-gqh8-sfan Aliases: CVE-2023-28867 GHSA-p4qx-6w5p-4rj2	GraphQL Java vulnerable to stack consumption In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4 and 17.5.	17.5 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 18.4 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 19.4 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 20.1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-5z1v-pkb5-d7e7
Aliases:
CVE-2024-40094
GHSA-h9mq-f6q5-6c8m

GraphQL Java does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.

19.11
Affected by 0 other vulnerabilities.

20.9
Affected by 0 other vulnerabilities.

21.5
Affected by 0 other vulnerabilities.

VCID-gwdw-gqh8-sfan
Aliases:
CVE-2023-28867
GHSA-p4qx-6w5p-4rj2

GraphQL Java vulnerable to stack consumption In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4 and 17.5.

17.5
Affected by 1 other vulnerability.

18.4
Affected by 1 other vulnerability.

19.4
Affected by 1 other vulnerability.

20.1
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
VCID-7tre-pj2q-4ugh	graphql-java: DoS by malicious query	CVE-2022-37734 GHSA-v62j-cxhh-fq22

Vulnerability

Summary

Aliases

VCID-7tre-pj2q-4ugh

graphql-java: DoS by malicious query

CVE-2022-37734
GHSA-v62j-cxhh-fq22

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-06T05:15:39.273307+00:00	GitLab Importer	Affected by	VCID-5z1v-pkb5-d7e7	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/com.graphql-java/graphql-java/CVE-2024-40094.yml	38.6.0
2026-06-06T03:37:18.700466+00:00	GitLab Importer	Affected by	VCID-gwdw-gqh8-sfan	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/com.graphql-java/graphql-java/CVE-2023-28867.yml	38.6.0
2026-06-05T21:34:04.964910+00:00	GHSA Importer	Fixing	VCID-7tre-pj2q-4ugh	https://github.com/advisories/GHSA-v62j-cxhh-fq22	38.6.0
2026-06-05T17:11:45.384738+00:00	GitLab Importer	Fixing	VCID-7tre-pj2q-4ugh	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/com.graphql-java/graphql-java/CVE-2022-37734.yml	38.6.0
2026-06-04T17:45:30.399685+00:00	GithubOSV Importer	Fixing	VCID-7tre-pj2q-4ugh	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-v62j-cxhh-fq22/GHSA-v62j-cxhh-fq22.json	38.6.0