CVE-2026-33756: Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching
Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL operations in a single HTTP request as a JSON array but wasn't enforcing any upper limit on the number of operations. This allowed an unauthenticated attacker to send a single HTTP request many operations (bypassing the per query complexity limit) to exhaust resources. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Saleorto a version that resolves this vulnerability.Fixed in 3.23.0a3 - Upgrade
Upgrade
Saleorto a version that resolves this vulnerability.Fixed in 3.22.47 - Upgrade
Upgrade
Saleorto a version that resolves this vulnerability.Fixed in 3.21.54 - Upgrade
Upgrade
Saleorto a version that resolves this vulnerability.Fixed in 3.20.118
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33756?
CVE-2026-33756 is classified as a Denial of Service vulnerability.
How do I fix CVE-2026-33756?
To fix CVE-2026-33756, upgrade Saleor to version 3.23.0 or later, or to the latest version in the 3.20.x, 3.21.x, or 3.22.x series.
Which versions of Saleor are affected by CVE-2026-33756?
CVE-2026-33756 impacts Saleor versions from 2.0.0 up to, but not including, 3.23.0a3, as well as several other specified versions.
What does CVE-2026-33756 allow an attacker to do?
CVE-2026-33756 allows an attacker to exploit unbounded GraphQL query batching, potentially leading to service denial.
Is there a known exploit for CVE-2026-33756?
As of now, there is no public information indicating that CVE-2026-33756 has been actively exploited in the wild.