Skip to content
Fencer Vulns
medium 5.3

CVE-2024-40094 json

GraphQL Java does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service

published 2024-07-30 2 y ago modified 2026-09-10 1 mo ago also GHSA-h9mq-f6q5-6c8m , EUVD-2024-2357

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 61%
public exploits
0
none known

Summary

GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.

Patch / fix

  • maven com.graphql-java:graphql-java 19.11, 20.9, 21.5

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-40094 updated cvss 5.9

graphql-java: GraphQL Java: Denial of Service via introspection queries

  • Red Hat Fuse 7 graphql-java Red Hat Integration Camel K 1 graphql-java Red Hat JBoss Enterprise Application Platform 7 graphql-java
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Cryostat 3 on RHEL 8 cryostat-tech-preview/cryostat-rhel8 3.0.1-5, cryostat-tech-preview/cryostat-db-rhel8 3.0.1-5, cryostat-tech-preview/jfr-datasource-rhel8 3.0.1-5, cryostat-tech-preview/cryostat-reports-rhel8 3.0.1-5, cryostat-tech-preview/cryostat-storage-rhel8 3.0.1-5, cryostat-tech-preview/cryostat-rhel8-operator 3.0.1-5, +3 more
    fixed: vendor fix RHSA-2024:8329
  • Red Hat build of Quarkus Native builder
    fixed: vendor fix RHSA-2024:7676
  • Red Hat OpenShift Serverless 1.35 openshift-serverless-1/logic-rhel8-operator 1.35.0-6, openshift-serverless-1/logic-operator-bundle 1.35.0-5, openshift-serverless-1/logic-swf-builder-rhel8 1.35.0-6, openshift-serverless-1/logic-swf-devmode-rhel8 1.35.0-6, openshift-serverless-1/logic-management-console-rhel8 1.35.0-5, openshift-serverless-1/logic-data-index-ephemeral-rhel8 1.35.0-5, +4 more
    fixed: vendor fix RHSA-2025:0664
  • Red Hat build of Apicurio Registry 2 graphql-java Red Hat JBoss Enterprise Application Platform 8 graphql-java Red Hat JBoss Enterprise Application Platform Expansion Pack graphql-java
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.95% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven com.graphql-java:graphql-java
<19.11
>=20.0, <20.9
>=21.0, <21.5
19.11
20.9
21.5

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.