CVE-2026-80051: Medium severity github.com/graphql-go/graphql vulnerability
github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions (scalars.go) accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising the request error that the GraphQL specification mandates. In some cases (but not any typical case of JSON sent to a website), a deeply nested value leads to an unrecoverable "fatal error: stack overflow" condition.
Affected Software
Event History
Frequently Asked Questions
What deployments are realistically exposed to the denial-of-service condition?
Deployments using github.com/graphql-go/graphql through 0.8.1 may be exposed when they process scalar variable values that do not match their declared String, ID, or Boolean type. The stack-overflow condition requires a deeply nested value and is not described as occurring with typical JSON sent to a website.
What does an attacker need to send to trigger the issue?
The attacker needs to provide a variable value whose actual type does not match a declared String, ID, or Boolean scalar. For the unrecoverable stack overflow, the mismatched value must also be deeply nested.
How can I determine whether my application is affected?
Check whether it uses github.com/graphql-go/graphql version 0.8.1 or earlier. Also review whether untrusted requests can supply GraphQL variable values for String, ID, or Boolean fields and whether non-typical, deeply nested input representations can reach the scalar coercion functions.