Uncontrolled Resource Consumption (DoS) in Magento GraphQL Query Processing

Unauthenticated attackers can exhaust server resources (CPU/memory/stack) by sending specially crafted GraphQL queries — e.g. deeply nested inline fragments — to the GraphQL endpoint, causing denial of service. Adobe APSB26-49.

This vulnerability affects the following application versions:

• Magento 2.4.7



• Magento 2.4.7-beta1



• Magento 2.4.7-beta2



• Magento 2.4.7-beta3



• Magento 2.4.7-p1



• Magento 2.4.7-p2



• Magento 2.4.7-p3



• Magento 2.4.7-p4



• Magento 2.4.7-p5



• Magento 2.4.7-p6



• Magento 2.4.7-p7



• Magento 2.4.7-p8



• Magento 2.4.7-p9



• Magento 2.4.8



• Magento 2.4.8-beta1



• Magento 2.4.8-beta2



• Magento 2.4.8-p1



• Magento 2.4.8-p2



• Magento 2.4.8-p3



• Magento 2.4.8-p4



• Magento 2.4.9-alpha1



• Magento 2.4.9-alpha2



• Magento 2.4.9-alpha3



• Magento 2.4.9-beta1