GHSA-pfrg-qg4f-grmv: Unbounded memory use on large request bodies

Q: Which deployments are exposed to this issue?

Deployments using the graphql() or graphql_sync() functions of juniper_hyper to handle POST requests are exposed if those functions do not enforce a request-body size limit. The affected request requires no authentication.

Q: What does an attacker need to do to trigger the denial of service?

An attacker only needs network access to send a sufficiently large POST request body to a vulnerable GraphQL endpoint. Because the body is read fully into memory before parsing, repeated or large requests can exhaust server memory.

Q: What is the default protection in juniper_hyper 0.10.1?

juniper_hyper 0.10.1 limits request bodies to 2 MiB by default. Requests exceeding that limit receive a 413 Payload Too Large response.

Q: Can the request-body limit be changed for a specific request?

Yes. A juniper_hyper::BodyLimit placed in a request's extensions changes the body-size limit for that request.

Published Oct 28, 2026

Updated

The graphql() and graphqlsync() functions of juniperhyper read the whole body of a POST request into memory before they parsed the body. The functions had no limit on the size of the body. A client could thus send a large body and exhaust the memory of the server. The request needs no authentication.

juniperhyper 0.10.1 reads at most 2 MiB of a request body by default. The functions respond with 413 Payload Too Large to larger bodies. A juniperhyper::BodyLimit in the extensions of a request changes the limit for the request.

Affected Software

1 affected componentFixes available

rust/juniper_hyper>=0.0.0-0<0.10.1

0.10.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rust/juniper_hyper to a version that resolves this vulnerability.
Fixed in 0.10.1

Event History

Oct 28, 2026

Advisory Published

via OSV·12:00 PM

Data Sourced

via OSV·12:00 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the graphql() or graphql_sync() functions of juniper_hyper to handle POST requests are exposed if those functions do not enforce a request-body size limit. The affected request requires no authentication.

What does an attacker need to do to trigger the denial of service?

An attacker only needs network access to send a sufficiently large POST request body to a vulnerable GraphQL endpoint. Because the body is read fully into memory before parsing, repeated or large requests can exhaust server memory.

What is the default protection in juniper_hyper 0.10.1?

juniper_hyper 0.10.1 limits request bodies to 2 MiB by default. Requests exceeding that limit receive a 413 Payload Too Large response.

Can the request-body limit be changed for a specific request?

Yes. A juniper_hyper::BodyLimit placed in a request's extensions changes the body-size limit for that request.

GHSA-pfrg-qg4f-grmv: Unbounded memory use on large request bodies

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the default protection in juniper_hyper 0.10.1?

Can the request-body limit be changed for a specific request?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the default protection in juniper_hyper 0.10.1?

Can the request-body limit be changed for a specific request?