{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/traggo-server-0.8.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:traggo:server:0.8.3:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-117184"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Traggo server (0.8.3)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","graphql","webserver"],"_cs_type":"advisory","_cs_vendors":["Traggo"],"content_html":"\u003cp\u003eTraggo server version 0.8.3 is vulnerable to an unauthenticated Denial of Service (CVE-2026-117184). The application lacks input size validation on the \u003ccode\u003e/graphql\u003c/code\u003e endpoint and fails to enforce complexity limits for GraphQL queries. An attacker can submit a crafted request containing a large number of aliased fields, forcing the server to perform excessive resolver operations, leading to CPU exhaustion and high memory usage (OOM). The vulnerability is currently reserved and the project is awaiting a fix.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to induce high CPU usage and significant memory pressure. A single payload of approximately 2 MB with 100,000 aliases was observed to consume nearly 1 GB of RAM and pin a CPU core for over 100 seconds, potentially rendering the service unresponsive.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement \u003ccode\u003ehttp.MaxBytesReader\u003c/code\u003e on the \u003ccode\u003e/graphql\u003c/code\u003e handler to restrict request body size to a reasonable threshold (e.g., 1 MB).\u003c/li\u003e\n\u003cli\u003eConfigure the GraphQL handler to enforce a \u003ccode\u003eComplexityLimit\u003c/code\u003e to prevent resource-intensive queries.\u003c/li\u003e\n\u003cli\u003eRestrict access to the \u003ccode\u003eversion\u003c/code\u003e field by applying an authentication directive such as \u003ccode\u003e@hasRole(role: USER)\u003c/code\u003e in \u003ccode\u003eschema.graphql\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eMonitor Traggo server repository for the release of version 0.8.4 or subsequent patches.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T11:42:01Z","date_published":"2026-10-30T11:42:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-traggo-graphql-dos/","summary":"Traggo server v0.8.3 is vulnerable to an unauthenticated Denial of Service due to a lack of complexity and size limits on the /graphql endpoint, allowing attackers to exhaust CPU and memory resources.","title":"Traggo Server: Unauthenticated Denial of Service via GraphQL Alias Overloading (CVE-2026-117184)","url":"https://feed.craftedsignal.io/briefs/2026-10-traggo-graphql-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Traggo Server (0.8.3)","version":"https://jsonfeed.org/version/1.1"}