https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T06:47:10.233691+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-191949 EUVD-2026-191949 2026-10-07T06:47:10.283072+00:00 EUVD-2026-191949 https://cve.radiocsirt.org/vuln/fkie_cve-2024-47614 fkie_cve-2024-47614 2026-10-07T06:47:10.283114+00:00

async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of directives for a field. This can lead to Service Disruption, Resource Exhaustion, and User Experience Degradation. This vulnerability is fixed in 7.0.10.

 https://cve.radiocsirt.org/vuln/ghsa-5gc2-7c65-8fq8 GHSA-5gc2-7c65-8fq8 — async-graphql Directive Overload 2026-10-07T06:47:10.283150+00:00

Affected: crates.io: async-graphql

### Impact

- Service Disruption: The server may become unresponsive or extremely slow, potentially leading to downtime. - Resource Exhaustion: Excessive use of server resources, such as CPU and memory, could negatively impact other services running on the same infrastructure. - User Experience Degradation: Users may experience delays or failures when accessing the service, which could lead to frustration and loss of trust in the service.

### Patches

1. Upgrade to v7.0.10 2. Use [SchemaBuilder.limit_directives](https://docs.rs/async-graphql/latest/async_graphql/struct.SchemaBuilder.html#method.limit_directives) to limit the maximum number of directives for a single field.