Executive brief
SmallRye GraphQL is a library used to build GraphQL APIs in Java applications. A flaw in its numeric input validation allows unauthenticated attackers to send specially crafted GraphQL queries that cause excessive memory allocation and CPU consumption, forcing the application to crash or become unresponsive. This impacts the availability of any service exposing a GraphQL endpoint.
Technical details
The vulnerability exists in SmallRye GraphQL's scalar coercion logic for BigInteger, which fails to properly validate the magnitude of float or string inputs before processing. An unauthenticated remote attacker can exploit this by sending a GraphQL query with a large-exponent float literal (e.g., 1e999999). The library attempts to coerce this into a BigInteger, triggering allocation of extremely large objects that exhaust CPU and heap memory, resulting in denial of service via OutOfMemoryError or CPU exhaustion. The parsing occurs before authorization checks, making this attack trivial to trigger. Mitigation includes using GraphQL variables instead of inline literals, implementing numeric precision validation, or adding rate-limiting and timeouts to the endpoint. A patch is expected from the SmallRye project.
Affected products
- SmallRye GraphQL
Timeline
- 2026-08-31: disclosed