CVE-2026-80051
Received Received - Intake

Type Mismatch Vulnerability in GraphQL for Go

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: MITRE

Description
github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions (scalars.go) accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising the request error that the GraphQL specification mandates. In some cases (but not any typical case of JSON sent to a website), a deeply nested value leads to an unrecoverable "fatal error: stack overflow" condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-80051
EUVD
EUVD-2026-65681

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
github.com graphql-go graphql
graphql-go graphql to 0.8.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1287 The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the graphql-go/graphql library (up to v0.8.1) due to improper validation of scalar input types. The coerceString and coerceBool functions fail to validate input against declared scalar types (String, ID, or Boolean), causing type confusion and a denial-of-service (DoS) condition. Deeply nested non-string values can trigger a stack overflow, leading to process termination.

Detection Guidance

Detecting this vulnerability requires checking if your system uses the affected graphql-go/graphql library version (up to v0.8.1). Inspect your Go module dependencies for github.com/graphql-go/graphql. No specific commands are provided in the context, but you can use Go tools like 'go list -m all' to check versions.

Impact Analysis

The DoS requires extreme nesting depths (around 600,000 levels), making it unlikely via standard JSON inputs but possible through non-JSON transports or crafted payloads. Type confusion may lead to incorrect data processing if downstream code relies on strict type enforcement, but standalone impact is limited.

Compliance Impact

This vulnerability primarily causes a denial-of-service (DoS) condition via stack overflow due to improper type validation in scalar inputs. It does not directly expose or leak sensitive data, which limits its direct impact on GDPR or HIPAA compliance. However, the type confusion flaw violates GraphQL specification requirements, which could lead to unintended data processing if downstream code relies on strict type enforcement. Compliance risks may arise if the DoS disrupts services handling regulated data, but the vulnerability itself does not inherently violate GDPR or HIPAA.

Mitigation Strategies

Immediately upgrade to a patched version of graphql-go/graphql if available. If no patch exists, restrict access to GraphQL endpoints and validate all scalar inputs manually. Avoid using non-JSON transports for GraphQL queries to prevent deep nesting attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80051. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart