Traggo server: Uncontrolled resource consumption via GraphQL aliases
The GraphQL endpoint of Traggo server v0.8.3 accepts an unlimited number of aliased fields and has no request body size limit. The version field can be queried without authentication, so a single crafted POST request with many aliases can pin a CPU core and consume about 1 GB of RAM. Parallel requests can push the process into out-of-memory conditions and stop the service. Confidentiality and integrity are not affected according to the CVSS vector.
Traggo · Traggo server
