CVE-2026-80051: CWE-1287 Improper Validation of Specified Type of Input in graphql-go project graphql-go

CVE-2026-80051 describes an improper validation vulnerability in the graphql-go project (GraphQL for Go) up to version 0.8.1. The issue arises because the built-in scalar coercion functions (coerceString and coerceBool) do not enforce type matching for scalar variables declared as String, ID, or Boolean. Instead of rejecting mismatched input types with an error, these functions accept them, violating the GraphQL specification. In certain deeply nested input scenarios, this flaw can cause an unrecoverable stack overflow fatal error. Typical JSON inputs to websites are not affected by this stack overflow condition.

This vulnerability can cause denial of service due to a fatal stack overflow error when processing certain deeply nested inputs with mismatched scalar types. It violates the GraphQL specification by not properly validating input types, potentially leading to application crashes. There is no indication of remote code execution or data leakage. The CVSS 4.0 base score is 5.9 (medium severity), reflecting the local attack vector and the potential for partial impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, avoid processing untrusted deeply nested inputs that could trigger the stack overflow. Monitor vendor channels for updates and apply official fixes once released.