CVE-2021-47713

Hasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL Query

HIGH 8.7EPSS 0.5%

Hasura GraphQL 1.3.3 contains a denial of service vulnerability that allows attackers to overwhelm the service by crafting malicious GraphQL queries with excessive nested fields. Attackers can send repeated requests with extremely long query strings and multiple threads to consume server resources and potentially crash the GraphQL endpoint.

Affected: Hasura · Hasura GraphQL
CVSS v4.0 VULNCHECK: 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 VULNCHECK: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.48% chance of exploitation in the next 30 days, 40th percentile
Published: 2025-12-22
Updated: 2026-08-14

Proof-of-concept exploits (1)

https://www.exploit-db.com/exploits/49789

Security advisories

https://www.vulncheck.com/advisories/hasura-graphql-denial-of-service-via-malicious-graph…
hasura/graphql-engine

References

CVE Record
NVD entry