CVE-2026-33756

Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL operations in a single HTTP request as a JSON array but wasn't enforcing any upper limit on the number of operations. This allowed an unauthenticated attacker to send a single HTTP request many operations (bypassing the per query complexity limit) to exhaust resources. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64	Patch
https://github.com/saleor/saleor/commit/cdb66da97abb7c86939e384914cd8d9194f378e8	Patch
https://github.com/saleor/saleor/commit/d6a94e95bd77f3f733fa66afd1b1ac72e863ca2a	Patch
https://github.com/saleor/saleor/commit/e42aa4d6e588982e78942b033af051c8ec8f43fa	Patch
https://github.com/saleor/saleor/commit/f0371bdd4cafcc841f1a9e7049cead6133bf7464	Patch
https://github.com/saleor/saleor/security/advisories/GHSA-24jw-f244-qfpp	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:saleor:saleor::::::::
	cpe:2.3:a:saleor:saleor::::::::
	cpe:2.3:a:saleor:saleor::::::::
	cpe:2.3:a:saleor:saleor:3.23.0:alpha0::::::
	cpe:2.3:a:saleor:saleor:3.23.0:alpha1::::::
	cpe:2.3:a:saleor:saleor:3.23.0:alpha2::::::

History

No history.

Information

Published : 2026-04-08 18:26

Updated : 2026-07-24 22:10

NVD link : CVE-2026-33756

Mitre link : CVE-2026-33756

CVE.ORG link : CVE-2026-33756

JSON object : View

Products Affected

saleor

saleor

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-33756", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33756", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T18:42:19.130571Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "saleor", "product": "saleor", "versions": [{"status": "affected", "version": ">= 2.0.0, < 3.20.118"}, {"status": "affected", "version": ">= 3.21.0-a.0, < 3.21.54"}, {"status": "affected", "version": ">= 3.22.0-a.0, < 3.22.47"}, {"status": "affected", "version": ">= 3.23.0-a.0, < 3.23.0a3"}]}]}], "published": "2026-04-08T18:26:00.700", "references": [{"url": "https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/saleor/saleor/commit/cdb66da97abb7c86939e384914cd8d9194f378e8", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/saleor/saleor/commit/d6a94e95bd77f3f733fa66afd1b1ac72e863ca2a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/saleor/saleor/commit/e42aa4d6e588982e78942b033af051c8ec8f43fa", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/saleor/saleor/commit/f0371bdd4cafcc841f1a9e7049cead6133bf7464", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/saleor/saleor/security/advisories/GHSA-24jw-f244-qfpp", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL operations in a single HTTP request as a JSON array but wasn't enforcing any upper limit on the number of operations. This allowed an unauthenticated attacker to send a single HTTP request many operations (bypassing the per query complexity limit) to exhaust resources. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118."}, {"lang": "es", "value": "Saleor es una plataforma de comercio electr\u00f3nico. Desde la versi\u00f3n 2.0.0 hasta antes de las versiones 3.23.0a3, 3.22.47, 3.21.54 y 3.20.118, Saleor soporta el procesamiento por lotes de consultas al enviar m\u00faltiples operaciones GraphQL en una \u00fanica solicitud HTTP como un array JSON, pero no estaba aplicando ning\u00fan l\u00edmite superior en el n\u00famero de operaciones. Esto permit\u00eda a un atacante no autenticado enviar muchas operaciones en una \u00fanica solicitud HTTP (eludiendo el l\u00edmite de complejidad por consulta) para agotar los recursos. Esta vulnerabilidad est\u00e1 corregida en las versiones 3.23.0a3, 3.22.47, 3.21.54 y 3.20.118."}], "lastModified": "2026-07-24T22:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B4A5EA6-A42E-41BA-9A75-20C9FF65EE98", "versionEndExcluding": "3.20.118", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2312AF3F-A049-4E4B-AAEF-21D7B5463A3A", "versionEndExcluding": "3.21.54", "versionStartIncluding": "3.21.0"}, {"criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ABB6E342-967D-4F4D-9869-BC24C630ACEF", "versionEndExcluding": "3.22.47", "versionStartIncluding": "3.22.0"}, {"criteria": "cpe:2.3:a:saleor:saleor:3.23.0:alpha0:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "086CBDFF-B1C4-4AD4-9F39-00B028E29338"}, {"criteria": "cpe:2.3:a:saleor:saleor:3.23.0:alpha1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "404B7EE8-9CE0-4B8D-B0B7-2DF60F355E72"}, {"criteria": "cpe:2.3:a:saleor:saleor:3.23.0:alpha2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DD7D745-F558-4CBE-9110-2F7DCBCF4D2F"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}