{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-27097", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-02-18T16:44:48.764Z", "datePublished": "2025-02-20T20:15:53.648Z", "dateUpdated": "2025-02-20T21:01:18.158Z"}, "containers": {"cna": {"title": "Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operation", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-rr4x-crhf-8886", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-rr4x-crhf-8886"}], "affected": [{"vendor": "ardatan", "product": "graphql-mesh", "versions": [{"version": "@graphql-mesh/runtime: >= 0.96.9, < 0.96.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-02-20T20:15:53.648Z"}, "descriptions": [{"lang": "en", "value": "GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial variables are used in all following requests until the cache evicts DocumentNode. If a token is sent via variables, the following requests will act like the same token is sent even if the following requests have different tokens. This can cause a short memory leak but it won't grow per each request but per different operation until the cache evicts DocumentNode by LRU mechanism."}], "source": {"advisory": "GHSA-rr4x-crhf-8886", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-20T21:01:06.546548Z", "id": "CVE-2025-27097", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-20T21:01:18.158Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-27097", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-20T21:01:06.546548Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-20T21:01:13.916Z"}}], "cna": {"title": "Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operation", "source": {"advisory": "GHSA-rr4x-crhf-8886", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "ardatan", "product": "graphql-mesh", "versions": [{"status": "affected", "version": "@graphql-mesh/runtime: >= 0.96.9, < 0.96.9"}]}], "references": [{"url": "https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-rr4x-crhf-8886", "name": "https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-rr4x-crhf-8886", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial variables are used in all following requests until the cache evicts DocumentNode. If a token is sent via variables, the following requests will act like the same token is sent even if the following requests have different tokens. This can cause a short memory leak but it won't grow per each request but per different operation until the cache evicts DocumentNode by LRU mechanism."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-02-20T20:15:53.648Z"}}}, "cveMetadata": {"cveId": "CVE-2025-27097", "state": "PUBLISHED", "dateUpdated": "2025-02-20T21:01:18.158Z", "dateReserved": "2025-02-18T16:44:48.764Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-02-20T20:15:53.648Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:the-guild:graphql_mesh:0.96.5:*:*:*:*:node.js:*:*", "matchCriteriaId": "BE510785-F022-4152-8536-1322352F0698", "vulnerable": true}, {"criteria": "cpe:2.3:a:the-guild:graphql_mesh:0.96.6:*:*:*:*:node.js:*:*", "matchCriteriaId": "2D484264-71CC-4CFC-8959-FC43C8E44D5D", "vulnerable": true}, {"criteria": "cpe:2.3:a:the-guild:graphql_mesh:0.96.7:*:*:*:*:node.js:*:*", "matchCriteriaId": "42D32CD2-98C5-49CB-A66E-F9F72F560073", "vulnerable": true}, {"criteria": "cpe:2.3:a:the-guild:graphql_mesh:0.96.8:*:*:*:*:node.js:*:*", "matchCriteriaId": "B077BCC7-800F-43F3-AB05-6F7B3C05F0AA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial variables are used in all following requests until the cache evicts DocumentNode. If a token is sent via variables, the following requests will act like the same token is sent even if the following requests have different tokens. This can cause a short memory leak but it won't grow per each request but per different operation until the cache evicts DocumentNode by LRU mechanism."}, {"lang": "es", "value": "GraphQL Mesh es un framework de trabajo y una puerta de enlace de GraphQL Federation para GraphQL Federation y subgrafos que no son de GraphQL Federation, servicios que no son de GraphQL, como REST y gRPC, y tambi\u00e9n bases de datos como MongoDB, MySQL y PostgreSQL. Cuando un usuario realiza una transformaci\u00f3n en el nivel superusuario o en una \u00fanica fuente con transformaciones, y el cliente env\u00eda la misma consulta con diferentes variables, las variables iniciales se utilizan en todas las solicitudes siguientes hasta que la memoria cach\u00e9 expulsa a DocumentNode. Si se env\u00eda un token a trav\u00e9s de variables, las solicitudes siguientes actuar\u00e1n como si se enviara el mismo token, incluso si las solicitudes siguientes tienen tokens diferentes. Esto puede provocar una breve p\u00e9rdida de memoria, pero no aumentar\u00e1 con cada solicitud, sino con cada operaci\u00f3n diferente hasta que la memoria cach\u00e9 expulse a DocumentNode mediante el mecanismo LRU."}], "id": "CVE-2025-27097", "lastModified": "2025-02-27T20:18:12.583", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2025-02-20T21:15:26.227", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-rr4x-crhf-8886"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{}