CVE-2026-80051: GraphQL for Go DOS Vulnerability

CVE-2026-80051 Overview

CVE-2026-80051 affects github.com/graphql-go/graphql, a GraphQL implementation for the Go programming language, through version 0.8.1. The library fails to validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions in scalars.go accept input whose type does not match the declared String, ID, or Boolean scalar. This violates the GraphQL specification, which mandates a request error in these cases. Under specific conditions involving deeply nested values, the flaw triggers an unrecoverable fatal error: stack overflow, terminating the process.

Critical Impact

An attacker with local access can send crafted GraphQL variables that bypass scalar type validation and, in edge cases, crash the server process through stack exhaustion.

Affected Products

• github.com/graphql-go/graphql (GraphQL for Go) through version 0.8.1
• Go applications embedding the graphql-go/graphql library
• Services exposing GraphQL endpoints backed by the affected library

Discovery Timeline

• 2026-08-25 - CVE-2026-80051 published to the National Vulnerability Database (NVD)
• 2026-08-25 - Disclosure posted to the OpenWall oss-security mailing list
• 2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-80051

Vulnerability Analysis

The vulnerability is an improper input validation issue classified under [CWE-1287] (Improper Validation of Specified Type of Input). The GraphQL specification requires that variable values match their declared scalar type, and mismatches must produce a request error before execution begins. The graphql-go/graphql library does not enforce this contract for the String, ID, and Boolean scalar types.

When a client submits a variable whose JSON type does not match the schema's declared scalar type, the coercion functions accept the value instead of rejecting it. Downstream resolvers then receive data of an unexpected shape, which can lead to logic errors, type assertions failing at runtime, or, in edge cases, unbounded recursion during coercion.

The secondary impact is a denial-of-service condition. Deeply nested input values sent to the affected coercion path cause recursive traversal that exhausts the Go runtime stack. Because a Go stack overflow is a fatal error, it cannot be recovered with recover(), and the entire process terminates.

Root Cause

The root cause lives in the coerceString and coerceBool functions in scalars.go. These functions coerce arbitrary input values into their target scalar representation without first verifying that the input's underlying type matches the declared scalar. The functions also lack depth limits on recursive traversal of composite input values, allowing deeply nested structures to consume unbounded stack frames.

Attack Vector

The advertised attack vector is local. An attacker who can submit GraphQL operations with attacker-controlled variables can supply values whose types do not match the schema's declared scalar types. In typical JSON payloads sent to web endpoints, the stack-overflow condition does not trigger, per the advisory. The condition arises only with deeply nested variable values reaching the vulnerable coercion path. The vulnerability compromises availability without affecting confidentiality or integrity.

The vulnerability is described in prose because no verified proof-of-concept code has been published. See the OpenWall OSS-Security advisory for additional technical details.

Detection Methods for CVE-2026-80051

Indicators of Compromise

• Unexpected process termination of Go services embedding graphql-go/graphql, with logs containing fatal error: stack overflow and Go runtime goroutine dumps.
• GraphQL request logs showing variables with deeply nested JSON structures directed at operations that declare String, ID, or Boolean scalar variables.
• Resolver panics or type assertion failures downstream of variable coercion, indicating that mistyped values reached business logic.

Detection Strategies

• Inventory Go binaries and container images for use of github.com/graphql-go/graphql at or below version 0.8.1 using software composition analysis or go list -m all output.
• Instrument the GraphQL layer to log rejections and type mismatches between declared variable types and received JSON types.
• Alert on repeated GraphQL request payloads exceeding an expected nesting depth threshold, which is a strong signal of exploitation attempts.

Monitoring Recommendations

• Monitor process supervisors (systemd, Kubernetes liveness probes) for repeated restarts of GraphQL services, which indicate stack overflow crashes.
• Forward application logs to a centralized analytics platform and search for runtime.gopanic, runtime.morestack_noctxt, or fatal error: stack overflow patterns.
• Track GraphQL error rates and 5xx responses on endpoints backed by the affected library to identify anomalous spikes.

How to Mitigate CVE-2026-80051

Immediate Actions Required

• Identify all services depending on github.com/graphql-go/graphql at version 0.8.1 or earlier and prioritize them for remediation.
• Place a validating GraphQL gateway, API gateway, or web application firewall in front of exposed GraphQL endpoints to enforce request size and nesting depth limits.
• Restrict network exposure of GraphQL endpoints to trusted callers where feasible, aligning with the local attack vector characteristic of the vulnerability.

Patch Information

At the time of publication, the NVD entry lists no fixed version. Monitor the graphql-go/graphql repository and the OpenWall advisory for a patched release beyond 0.8.1. Once a fixed version is available, update the module using go get github.com/graphql-go/graphql@<fixed-version> and rebuild affected binaries.

Workarounds

• Implement a GraphQL middleware that validates JSON variable types against the operation's declared scalar types before invoking the library's coercion path.
• Enforce a maximum query and variable nesting depth using a validation rule to prevent deeply nested inputs from reaching the vulnerable functions.
• Apply request body size limits at the HTTP layer to reduce the feasibility of submitting pathologically nested payloads.
• Run GraphQL services under a process supervisor that restarts on crash, reducing availability impact until a patch is applied.