# CVE-2026-33756: Saleor resource exhaustion via unbounded GraphQL query batching

Source: https://junglewise.ai/threats/cve-2026-33756-saleor-resource-exhaustion-via-unbounded-graphql-query-batching  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-33756 · Severity: high · CVSS 7.5 · Published 2026-04-08

Saleor, an e-commerce platform, is vulnerable to a denial-of-service attack that can crash the store's website. An attacker can send a single specially crafted request containing thousands of simultaneous operations, overwhelming the server's processor and memory. This can lead to service outages, preventing customers from browsing or making purchases.

Technologies: [Saleor](https://junglewise.ai/threats/technologies/saleor). Vendors: [Saleor](https://junglewise.ai/threats/vendors/saleor).

## Quick answers

**Is CVE-2026-33756 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33756 being exploited in the wild.

**How severe is CVE-2026-33756?** High severity, with a CVSS score of 7.5, published 8 April 2026.

**Which products and versions are affected?** Saleor >= 2.0.0, < 3.20.118; >= 3.21.0, < 3.21.54; >= 3.22.0, < 3.22.47; >= 3.23.0, < 3.23.0a3.

**Is there a fix for CVE-2026-33756?** A patch was published on 2026-04-08: Fixes released in multiple branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33756 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-33756?** Check whether you run Saleor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Saleor supports GraphQL query batching by accepting multiple operations within a single JSON array in an HTTP request. Prior to the fix, the application did not enforce an upper limit on the number of batched operations, allowing attackers to bypass per-query complexity limits. By submitting a large number of operations in one request, an unauthenticated attacker can exhaust CPU, memory, and database connections, effectively blocking uvicorn async workers. The vulnerability is addressed by introducing GRAPHQL_MUTATION_COUNT_LIMIT and GRAPHQL_ALIAS_COUNT_LIMIT validators. Patches are available in versions 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

## Affected products

- Saleor Saleor >= 2.0.0, < 3.20.118; >= 3.21.0, < 3.21.54; >= 3.22.0, < 3.22.47; >= 3.23.0, < 3.23.0a3

## Timeline

- 2026-04-08: advisory: GHSA-24jw-f244-qfpp published by Saleor
- 2026-04-08: disclosed: CVE-2026-33756 assigned
- 2026-04-08: patched: Fixes released in multiple branches

## References

- [https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64](https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64)
- [https://github.com/saleor/saleor/commit/cdb66da97abb7c86939e384914cd8d9194f378e8](https://github.com/saleor/saleor/commit/cdb66da97abb7c86939e384914cd8d9194f378e8)
- [https://github.com/saleor/saleor/commit/d6a94e95bd77f3f733fa66afd1b1ac72e863ca2a](https://github.com/saleor/saleor/commit/d6a94e95bd77f3f733fa66afd1b1ac72e863ca2a)
- [https://github.com/saleor/saleor/commit/e42aa4d6e588982e78942b033af051c8ec8f43fa](https://github.com/saleor/saleor/commit/e42aa4d6e588982e78942b033af051c8ec8f43fa)
- [https://github.com/saleor/saleor/commit/f0371bdd4cafcc841f1a9e7049cead6133bf7464](https://github.com/saleor/saleor/commit/f0371bdd4cafcc841f1a9e7049cead6133bf7464)
- [https://github.com/saleor/saleor/security/advisories/GHSA-24jw-f244-qfpp](https://github.com/saleor/saleor/security/advisories/GHSA-24jw-f244-qfpp)

## Related threats

- [Saleor user enumeration in requestEmailChange mutation](https://junglewise.ai/threats/cve-2026-39851-saleor-user-enumeration-in-requestemailchange-mutation)
- [Saleor authorization bypass in email change workflow](https://junglewise.ai/threats/cve-2026-35407-saleor-authorization-bypass-in-email-change-workflow)
- [Saleor resource exhaustion via GraphQL query aliasing](https://junglewise.ai/threats/cve-2026-35401-saleor-resource-exhaustion-via-graphql-query-aliasing)
- [Saleor information leak in Local stock only pickup method](https://junglewise.ai/threats/cve-2024-29888-saleor-information-leak-in-local-stock-only-pickup-method)
- [Saleor information disclosure via Python exceptions in API error messages](https://junglewise.ai/threats/cve-2023-26051-saleor-information-disclosure-via-python-exceptions-in-api-error)