Aaron Moat

2 exploits Active since Sep 2023
CVE-2023-26144 WRITEUP MEDIUM WRITEUP
graphql 16.3.0-16.8.1 - Denial of Service via Large Query Parsing
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not proven that this vulnerability can crash the process.
CVSS 5.3
CVE-2024-4068 WRITEUP HIGH WRITEUP
braces < 3.0.3 - Denial of Service via Imbalanced Braces Input
The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
CVSS 7.5