Executive brief
Saleor is an e-commerce platform used to manage online storefronts and customer transactions. A vulnerability in its API allows attackers to send excessively complex requests that overwhelm the server's processing power. This can lead to a total service outage, preventing customers from browsing products or completing purchases.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in Saleor's GraphQL API due to insufficient throttling or limits on request complexity. An unauthenticated remote attacker can exploit this by submitting a single API call containing a large number of chained mutations or queries using GraphQL aliases. This causes the server to consume excessive CPU and memory resources while attempting to process the batch, leading to a Denial of Service (DoS). The issue is resolved in versions 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118. Temporary mitigations include implementing WAF rules to limit request body size or blocking GraphQL aliases and mutation chaining via regular expressions.
Affected products
- Saleor Saleor >= 2.0.0, < 3.20.118; >= 3.21.0, < 3.21.54; >= 3.22.0, < 3.22.47; >= 3.23.0, < 3.23.0a3
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
- 2026-04-08: patched