CVE-2026-64861: Probo: GraphQL Alias-Based Application Layer Denial of Service (DoS)
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.222.0, the GraphQL endpoint does not enforce restrictions on alias count, query depth, or query complexity. An attacker can send a single request containing thousands of aliased resolver calls, causing excessive server-side resource consumption and service degradation. This issue has been patched in version 0.222.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Proboto a version that resolves this vulnerability.Fixed in 0.222.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs network access to the Probo GraphQL endpoint and low-privileged credentials, as indicated by the required low privileges. No user interaction is required.
Are default GraphQL query limits sufficient to prevent exploitation?
No. Versions before 0.222.0 do not enforce limits on alias count, query depth, or query complexity at the GraphQL endpoint.
What is the recommended remediation?
Upgrade Probo to version 0.222.0, which patches the issue.
How can I determine whether my deployment is affected?
Deployments running a Probo version earlier than 0.222.0 are affected if their GraphQL endpoint is reachable by an attacker with low-privileged access.