CVE-2026-63637: Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter
Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/queryrewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dgraphto a version that resolves this vulnerability.Fixed in 25.3.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63637?
CVE-2026-63637 has a high severity rating of 8.6.
How do I fix CVE-2026-63637?
To remediate CVE-2026-63637, update Dgraph to version 25.3.8 or later.
What does CVE-2026-63637 affect?
CVE-2026-63637 affects Dgraph, an open-source distributed GraphQL database.
What type of vulnerability is CVE-2026-63637?
CVE-2026-63637 is a DQL injection vulnerability due to unvalidated regexp filter arguments.
When was CVE-2026-63637 published?
CVE-2026-63637 was published on August 6, 2026.