Executive brief
Saleor, an e-commerce platform, is vulnerable to a denial-of-service attack that can crash the store's website. An attacker can send a single specially crafted request containing thousands of simultaneous operations, overwhelming the server's processor and memory. This can lead to service outages, preventing customers from browsing or making purchases.
Technical details
Saleor supports GraphQL query batching by accepting multiple operations within a single JSON array in an HTTP request. Prior to the fix, the application did not enforce an upper limit on the number of batched operations, allowing attackers to bypass per-query complexity limits. By submitting a large number of operations in one request, an unauthenticated attacker can exhaust CPU, memory, and database connections, effectively blocking uvicorn async workers. The vulnerability is addressed by introducing GRAPHQL_MUTATION_COUNT_LIMIT and GRAPHQL_ALIAS_COUNT_LIMIT validators. Patches are available in versions 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.
Affected products
- Saleor Saleor >= 2.0.0, < 3.20.118; >= 3.21.0, < 3.21.54; >= 3.22.0, < 3.22.47; >= 3.23.0, < 3.23.0a3
Timeline
- 2026-04-08: advisory: GHSA-24jw-f244-qfpp published by Saleor
- 2026-04-08: disclosed: CVE-2026-33756 assigned
- 2026-04-08: patched: Fixes released in multiple branches
References
- https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64
- https://github.com/saleor/saleor/commit/cdb66da97abb7c86939e384914cd8d9194f378e8
- https://github.com/saleor/saleor/commit/d6a94e95bd77f3f733fa66afd1b1ac72e863ca2a
- https://github.com/saleor/saleor/commit/e42aa4d6e588982e78942b033af051c8ec8f43fa
- https://github.com/saleor/saleor/commit/f0371bdd4cafcc841f1a9e7049cead6133bf7464
- https://github.com/saleor/saleor/security/advisories/GHSA-24jw-f244-qfpp