CVE-2026-80051

github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions (scalars.go) accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising the request error that the GraphQL specification mandates. In some cases (but not any typical case of JSON sent to a website), a deeply nested value leads to an unrecoverable "fatal error: stack overflow" condition.

CVSS

No CVSS.

References

Link	Resource
https://github.com/graphql-go/graphql/blob/v0.8.1/scalars.go#L307-L315
https://www.openwall.com/lists/oss-security/2026/08/25/2

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-25 18:18

Updated : 2026-09-09 16:03

NVD link : CVE-2026-80051

Mitre link : CVE-2026-80051

CVE.ORG link : CVE-2026-80051

JSON object : View

Products Affected

No product.

CWE

CWE-1287

Improper Validation of Specified Type of Input

{"id": "CVE-2026-80051", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-80051", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T19:21:05.710528Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"repo": "https://github.com/graphql-go/graphql", "vendor": "graphql-go project", "product": "graphql-go", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.8.1"}], "packageURL": "pkg:golang/github.com/graphql-go/graphql", "packageName": "github.com/graphql-go/graphql", "programFiles": ["scalars.go"], "collectionURL": "https://pkg.go.dev", "defaultStatus": "unknown", "programRoutines": [{"name": "coerceString"}, {"name": "coerceBool"}]}]}], "published": "2026-08-25T18:18:07.120", "references": [{"url": "https://github.com/graphql-go/graphql/blob/v0.8.1/scalars.go#L307-L315", "source": "cve@mitre.org"}, {"url": "https://www.openwall.com/lists/oss-security/2026/08/25/2", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-1287"}]}], "descriptions": [{"lang": "en", "value": "github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions (scalars.go) accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising the request error that the GraphQL specification mandates. In some cases (but not any typical case of JSON sent to a website), a deeply nested value leads to an unrecoverable \"fatal error: stack overflow\" condition."}], "lastModified": "2026-09-09T16:03:22.897", "sourceIdentifier": "cve@mitre.org"}