https://seclists.org/oss-sec/2026/q3/570: graphql-go/graphql <= 0.8.1: improper scalar input-type validation -> type confusion and uncoverable stack-overflow DoS

Q: Which deployments are exposed to the denial-of-service condition?

Deployments using github.com/graphql-go/graphql are affected across all released versions through v0.8.1. The issue is reachable where an attacker can supply GraphQL variable values for String, ID, or Boolean inputs.

Q: What does an attacker need to send to trigger the process crash?

The attacker must provide a deeply nested non-string value in a variable declared as a String, ID, or Boolean scalar. For String and ID, the value reaches fmt.Sprintf("%v", value), where unbounded formatting recursion can cause a fatal Go stack overflow.

Q: Can application-level panic recovery prevent the denial of service?

No. The reported stack overflow is a Go fatal error that terminates the process and cannot be caught with recover().

Q: Is there an upstream fixed release to upgrade to?

No fixed version exists according to the report. All released versions up to and including v0.8.1 are affected.

Published Aug 25, 2026

Updated

Affected Software

1 affected component

github.com/graphql-go/graphql<=v0.8.1

Frequently Asked Questions

Which deployments are exposed to the denial-of-service condition?

Deployments using github.com/graphql-go/graphql are affected across all released versions through v0.8.1. The issue is reachable where an attacker can supply GraphQL variable values for String, ID, or Boolean inputs.

What does an attacker need to send to trigger the process crash?

The attacker must provide a deeply nested non-string value in a variable declared as a String, ID, or Boolean scalar. For String and ID, the value reaches fmt.Sprintf("%v", value), where unbounded formatting recursion can cause a fatal Go stack overflow.

Can application-level panic recovery prevent the denial of service?

No. The reported stack overflow is a Go fatal error that terminates the process and cannot be caught with recover().

Is there an upstream fixed release to upgrade to?

No fixed version exists according to the report. All released versions up to and including v0.8.1 are affected.