SCA: security update for org.typelevel:grackle-core_2.13, org.typelevel:grackle-core_3, org.typelevel:grackle-core_native0.4_2.13, org.typelevel:grackle-core_native0.4_3, org.typelevel:grackle-core_sjs1_2.13, org.typelevel:grackle-core_sjs1_3 (GHSA-g56x-7j6w-g8r8)

high Tenable Self-Hosted Container Security Plugin ID 414883

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL
specification requires that GraphQL fragments must not form cycles, either directly or indirectly. Prior
to Grackle version 0.18.0, that requirement wasn't checked, and queries with cyclic fragments would have
been accepted for type checking and compilation. The attempted compilation of such fragments would result
in a JVM `StackOverflowError` being thrown. Some knowledge of an applications GraphQL schema would be
required to construct such a query, however no knowledge of any application-specific performance or other
behavioural characteristics would be needed. Grackle uses the cats-parse library for parsing GraphQL
queries. Prior to version 0.18.0, Grackle made use of the cats-parse `recursive` operator. However,
`recursive` is not currently stack safe. `recursive` was used in three places in the parser: nested
selection sets, nested input values (lists and objects), and nested list type declarations. Consequently,
queries with deeply nested selection sets, input values or list types could be constructed which exploited
this, causing a JVM `StackOverflowException` to be thrown during parsing. Because this happens very early
in query processing, no specific knowledge of an applications GraphQL schema would be required to
construct such a query. The possibility of small queries resulting in stack overflow is a potential denial
of service vulnerability. This potentially affects all applications using Grackle which have untrusted
users. Both stack overflow issues have been resolved in the v0.18.0 release of Grackle. As a workaround,
users could interpose a sanitizing layer in between untrusted input and Grackle query processing.
(CVE-2023-50730)

Plugin Details

Severity: High

ID: 414883

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2023-50730

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/18/2023

Vulnerability Publication Date: 12/18/2023

Reference Information

CVE: CVE-2023-50730

cwe: CWE-400

Detections

Analytics