Rust advisories / async-graphql
Vulnerability HighRUSTSEC-2022-0037 · async-graphql
RUSTSEC-2022-0037: Denial of service on deeply nested fragment requests
Short answerA security vulnerability in the async-graphql crate: Denial of service on deeply nested fragment requests. High severity (CVSS 7.5). Fixed in 4.0.6: update to a fixed version.
| Crate | async-graphql |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | Before 4.0.6. |
| Fixed in | 4.0.6 |
| Severity | High, CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Published | 2022-07-21 |
| Last changed | 2026-02-04 |
| Also known as | GHSA-xq3c-8gqm-v648 |
What to do
- See which version you have:
cargo tree -i async-graphql(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p async-graphql. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampleasync-graphql = "4.0.6") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Deeply nested fragments in a GraphQL request may cause a stack overflow in the server.
References
- Package: crates.io/crates/async-graphql
- Advisory: rustsec.org/advisories/RUSTSEC-2022-0037.html
- Web: github.com/async-graphql/async-graphql/commit/521769b80039fc8043d1c9883e3d6e5b57359072
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for async-graphql
Up next
Same crateasync-graphql: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?