CVE-2026-35401: Saleor has a resource exhaustion vulnerability in GraphQL queries
Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a malicious actor can include many GraphQL mutations or queries in a single API call using aliases or chaining multiple mutations, resulting in resource exhaustion. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.23.0a3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.22.47 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.21.54 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.20.118
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35401?
CVE-2026-35401 is classified as a resource exhaustion vulnerability, allowing for potential denial of service attacks.
How do I fix CVE-2026-35401?
To fix CVE-2026-35401, update Saleor to version 3.23.0-alpha3 or later.
What specific versions of Saleor are affected by CVE-2026-35401?
CVE-2026-35401 affects Saleor versions from 2.0.0 up to but not including 3.23.0-alpha3.
What type of attack does CVE-2026-35401 enable?
CVE-2026-35401 enables attackers to perform denial of service attacks through excessively large GraphQL queries or mutations.
Is user input validation sufficient to mitigate CVE-2026-35401?
No, user input validation alone is not sufficient; implementing rate limiting and query complexity analysis is recommended.