« Volver al listado

CVE-2025-27097

Estado: AnalizadaMedia (5.1)—

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial variables are used in all following requests until the cache evicts DocumentNode. If a token is sent via variables, the following requests will act like the same token is sent even if the following requests have different tokens. This can cause a short memory leak but it won't grow per each request but per different operation until the cache evicts DocumentNode by LRU mechanism.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

The-guild — Graphql Mesh

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-27097",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-27097",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-20T21:01:06.546548Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "ardatan",
          "product": "graphql-mesh",
          "versions": [
            {
              "status": "affected",
              "version": "@graphql-mesh/runtime: >= 0.96.9, < 0.96.9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-02-20T21:15:26.227",
  "references": [
    {
      "url": "https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-rr4x-crhf-8886",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial variables are used in all following requests until the cache evicts DocumentNode. If a token is sent via variables, the following requests will act like the same token is sent even if the following requests have different tokens. This can cause a short memory leak but it won't grow per each request but per different operation until the cache evicts DocumentNode by LRU mechanism."
    },
    {
      "lang": "es",
      "value": "GraphQL Mesh es un framework de trabajo y una puerta de enlace de GraphQL Federation para GraphQL Federation y subgrafos que no son de GraphQL Federation, servicios que no son de GraphQL, como REST y gRPC, y también bases de datos como MongoDB, MySQL y PostgreSQL. Cuando un usuario realiza una transformación en el nivel superusuario o en una única fuente con transformaciones, y el cliente envía la misma consulta con diferentes variables, las variables iniciales se utilizan en todas las solicitudes siguientes hasta que la memoria caché expulsa a DocumentNode. Si se envía un token a través de variables, las solicitudes siguientes actuarán como si se enviara el mismo token, incluso si las solicitudes siguientes tienen tokens diferentes. Esto puede provocar una breve pérdida de memoria, pero no aumentará con cada solicitud, sino con cada operación diferente hasta que la memoria caché expulse a DocumentNode mediante el mecanismo LRU."
    }
  ],
  "lastModified": "2026-06-17T09:03:01.603",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:the-guild:graphql_mesh:0.96.5:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE510785-F022-4152-8536-1322352F0698"
            },
            {
              "criteria": "cpe:2.3:a:the-guild:graphql_mesh:0.96.6:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D484264-71CC-4CFC-8959-FC43C8E44D5D"
            },
            {
              "criteria": "cpe:2.3:a:the-guild:graphql_mesh:0.96.7:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42D32CD2-98C5-49CB-A66E-F9F72F560073"
            },
            {
              "criteria": "cpe:2.3:a:the-guild:graphql_mesh:0.96.8:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B077BCC7-800F-43F3-AB05-6F7B3C05F0AA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}