Traggo Server: Unauthenticated Denial of Service via GraphQL Alias Overloading (CVE-2026-117184)

Traggo server version 0.8.3 is vulnerable to an unauthenticated Denial of Service (CVE-2026-117184). The application lacks input size validation on the /graphql endpoint and fails to enforce complexity limits for GraphQL queries. An attacker can submit a crafted request containing a large number of aliased fields, forcing the server to perform excessive resolver operations, leading to CPU exhaustion and high memory usage (OOM). The vulnerability is currently reserved and the project is awaiting a fix.

Impact

Successful exploitation allows an unauthenticated attacker to induce high CPU usage and significant memory pressure. A single payload of approximately 2 MB with 100,000 aliases was observed to consume nearly 1 GB of RAM and pin a CPU core for over 100 seconds, potentially rendering the service unresponsive.

Recommendation

• Implement http.MaxBytesReader on the /graphql handler to restrict request body size to a reasonable threshold (e.g., 1 MB).
• Configure the GraphQL handler to enforce a ComplexityLimit to prevent resource-intensive queries.
• Restrict access to the version field by applying an authentication directive such as @hasRole(role: USER) in schema.graphql.
• Monitor Traggo server repository for the release of version 0.8.4 or subsequent patches.