The juniper_warp crate versions prior to 0.9.1 contain a vulnerability in the make_graphql_filter() and make_graphql_filter_sync() filters, which read the entire POST request body into memory without size limits. This allows an unauthenticated client to send a large request body and exhaust server memory, causing a denial of service. Version 0.9.1 and later implement a default 2 MiB limit on request body size and respond with 413 Payload Too Large for larger bodies, mitigating the issue.