GHSA-fj3h-2jc3-973v: Unbounded memory use on large request bodies
The makegraphqlfilter() and makegraphqlfiltersync() filters of juniperwarp read the whole body of a POST request into memory before they parsed the body. The filters had no limit on the size of the body. A client could thus send a large body and exhaust the memory of the server. The request needs no authentication.
juniperwarp 0.9.1 reads at most 2 MiB of a request body by default. The filters respond with 413 Payload Too Large to larger bodies. makegraphqlfilterwithbodylimit() and makegraphqlfiltersyncwithbodylimit() set another limit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/juniper_warpto a version that resolves this vulnerability.Fixed in 0.9.1