Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Juniper versions before 0.17.2 are vulnerable to a stack overflow when parsing, validating, or executing deeply nested GraphQL documents, such as deeply nested selection sets or long chains of fragment spreads. An unauthenticated attacker can send one such request to crash the whole process, which drops all other requests in progress. Upgrade to juniper 0.17.2, which limits nesting depth to 64 levels and document size to 15,000 tokens by default.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | OSV |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 31 Oct 2026, 14:24 UTC First seen by agentprime
- 31 Oct 2026, 14:24 UTC Confirmed by OSV