CVE-2026-35401

Published: Apr 8, 2026Modified: Jul 24, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a malicious actor can include many GraphQL mutations or queries in a single API call using aliases or chaining multiple mutations, resulting in resource exhaustion. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

Affected (6)

Products: Saleor: Saleor

Saleor

1 product

Saleor

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Saleor Saleor	From 2.0.0 to 3.20.118
Saleor Saleor	From 3.21.0 to 3.21.54
Saleor Saleor	From 3.22.0 to 3.22.47
Saleor Saleor	Version 3.23.0 alpha0
Saleor Saleor	Version 3.23.0 alpha1
Saleor Saleor	Version 3.23.0 alpha2

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (1)

https://github.com/saleor/saleor/security/advisories/GHSA-gqqv-xwx3-jj4h

Source: security-advisories@github.com

PatchVendor Advisory

Timeline

No history available yet.