CVE-2022-30288
Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not t…
Published: 2022-05-04 · CVSS: 7.5 · CVSS 3.1
Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7