Threats affecting pkg:cargo/juniper

The Juniper GraphQL library versions before 0.17.2 contain performance vulnerabilities where crafted GraphQL documents can cause excessive CPU and memory usage. These issues arise from inefficient validation and execution logic, including quadratic parsing time and exponential fragment expansion. The vulnerability allows unauthenticated requests to consume significant server resources, potentially leading to denial of service. Version 0.17.2 addresses these issues by imposing limits on tokens and fields, optimizing validation rules, and capping conflict reports.

Juniper versions prior to 0.17.2 contain a stack overflow vulnerability triggered by deeply nested GraphQL documents. The parser recursively processes each nesting level without limits, allowing an attacker to cause a stack overflow by submitting documents with excessive nesting or long chains of fragment spreads. This results in the server process aborting and dropping all ongoing requests. The vulnerability requires no authentication to exploit. Version 0.17.2 and later mitigate this by enforcing limits on nesting depth and token count.