maven package report

Is com.graphql-java:graphql-java safe?

3 known vulnerabilities, worst severity HIGH.

cvss

5.3

how bad it is if exploited, out of 10

epss

0.90%

chance of exploitation in the next 30 days

xyz score

3.4

CyberXYZ composite, out of 10

fig. 01 — GHSA-h9mq-f6q5-6c8m, the advisory selected below

// advisories

GHSA-h9mq-f6q5-6c8m

HIGHCVE-2024-40094

GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.

Affected: < 19.11, >= 20.0, < 20.9, >= 21.0, < 21.5
Fixed in: 19.11
Weakness: CWE-770
Published: 2024-07-30
Source: github

GHSA NVD MITRE reference reference reference reference reference reference reference reference reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.

Checked 2026-09-22 at 01:39 UTC. The most recent advisory here was published 2024-07-30. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is com.graphql-java:graphql-java safe? maven package security report | CyberXYZ