Is CVE-2026-33756 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33756 being exploited in the wild.

How severe is CVE-2026-33756?

High severity, with a CVSS score of 7.5, published 8 April 2026.

Which products and versions are affected?

Saleor >= 2.0.0, = 3.21.0, = 3.22.0, = 3.23.0, < 3.23.0a3.

Is there a fix for CVE-2026-33756?

A patch was published on 2026-04-08: Fixes released in multiple branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33756 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-33756?

Check whether you run Saleor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33756: Saleor resource exhaustion via unbounded GraphQL query batching

Q: Is there a fix for CVE-2026-33756?

A patch was published on 2026-04-08: Fixes released in multiple branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33756 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-33756?

Check whether you run Saleor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33756 · Severity: high · CVSS 7.5 · Published 2026-04-08

Saleor, an e-commerce platform, is vulnerable to a denial-of-service attack that can crash the store's website. An attacker can send a single specially crafted request containing thousands of simultaneous operations, overwhelming the server's processor and memory. This can lead to service outages, preventing customers from browsing or making purchases.

Technologies: Saleor. Vendors: Saleor.

Quick answers

Is CVE-2026-33756 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33756 being exploited in the wild.
How severe is CVE-2026-33756?: High severity, with a CVSS score of 7.5, published 8 April 2026.
Which products and versions are affected?: Saleor >= 2.0.0, < 3.20.118; >= 3.21.0, < 3.21.54; >= 3.22.0, < 3.22.47; >= 3.23.0, < 3.23.0a3.
Is there a fix for CVE-2026-33756?: A patch was published on 2026-04-08: Fixes released in multiple branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33756 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33756?: Check whether you run Saleor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Saleor supports GraphQL query batching by accepting multiple operations within a single JSON array in an HTTP request. Prior to the fix, the application did not enforce an upper limit on the number of batched operations, allowing attackers to bypass per-query complexity limits. By submitting a large number of operations in one request, an unauthenticated attacker can exhaust CPU, memory, and database connections, effectively blocking uvicorn async workers. The vulnerability is addressed by introducing GRAPHQL_MUTATION_COUNT_LIMIT and GRAPHQL_ALIAS_COUNT_LIMIT validators. Patches are available in versions 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

Affected products

Saleor Saleor >= 2.0.0, < 3.20.118; >= 3.21.0, < 3.21.54; >= 3.22.0, < 3.22.47; >= 3.23.0, < 3.23.0a3

Timeline

2026-04-08: advisory: GHSA-24jw-f244-qfpp published by Saleor
2026-04-08: disclosed: CVE-2026-33756 assigned
2026-04-08: patched: Fixes released in multiple branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.