Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-33756

Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL operations in a single HTTP request as a JSON array but wasn't enforcing any upper limit on the number of operations. This allowed an unauthenticated attacker to send a single HTTP request many operations (bypassing the per query complexity limit) to exhaust resources. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:a654a4ad37af3ff30c026f4df674731a6a9e567c54525aec9d0ba6a830cd9350
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"saleor","vendor":"saleor","versions":[{"status":"affected","version":">= 2.0.0, < 3.20.118"},{"status":"affected","version":">= 3.21.0-a.0, < 3.21.54"},{"status":"affected","version":">= 3.22.0-a.0, < 3.22.47"},{"status":"affected","version":">= 3.23.0-a.0, < 3.23.0a3"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:3eac2eab148e0f3308185fac5e0fef2c2548d1298e8b6c3c40d13b6814d7e6b7 · sha256:8058b827fc3b0e37… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:3eac2eab148e0f3308185fac5e0fef2c2548d1298e8b6c3c40d13b6814d7e6b7 · sha256:8058b827fc3b0e37… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-770","description":"CWE-770: Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:3eac2eab148e0f3308185fac5e0fef2c2548d1298e8b6c3c40d13b6814d7e6b7 · sha256:8058b827fc3b0e37… · /containers/cna/problemTypes/0/descriptions/0

Source references

6 source assertions
{"name":"https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64","tags":["x_refsource_MISC"],"url":"https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:3eac2eab148e0f3308185fac5e0fef2c2548d1298e8b6c3c40d13b6814d7e6b7 · sha256:8058b827fc3b0e37… · /containers/cna/references/1
{"name":"https://github.com/saleor/saleor/commit/cdb66da97abb7c86939e384914cd8d9194f378e8","tags":["x_refsource_MISC"],"url":"https://github.com/saleor/saleor/commit/cdb66da97abb7c86939e384914cd8d9194f378e8"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:3eac2eab148e0f3308185fac5e0fef2c2548d1298e8b6c3c40d13b6814d7e6b7 · sha256:8058b827fc3b0e37… · /containers/cna/references/2
{"name":"https://github.com/saleor/saleor/commit/d6a94e95bd77f3f733fa66afd1b1ac72e863ca2a","tags":["x_refsource_MISC"],"url":"https://github.com/saleor/saleor/commit/d6a94e95bd77f3f733fa66afd1b1ac72e863ca2a"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:3eac2eab148e0f3308185fac5e0fef2c2548d1298e8b6c3c40d13b6814d7e6b7 · sha256:8058b827fc3b0e37… · /containers/cna/references/3
{"name":"https://github.com/saleor/saleor/commit/e42aa4d6e588982e78942b033af051c8ec8f43fa","tags":["x_refsource_MISC"],"url":"https://github.com/saleor/saleor/commit/e42aa4d6e588982e78942b033af051c8ec8f43fa"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:3eac2eab148e0f3308185fac5e0fef2c2548d1298e8b6c3c40d13b6814d7e6b7 · sha256:8058b827fc3b0e37… · /containers/cna/references/4
{"name":"https://github.com/saleor/saleor/commit/f0371bdd4cafcc841f1a9e7049cead6133bf7464","tags":["x_refsource_MISC"],"url":"https://github.com/saleor/saleor/commit/f0371bdd4cafcc841f1a9e7049cead6133bf7464"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:3eac2eab148e0f3308185fac5e0fef2c2548d1298e8b6c3c40d13b6814d7e6b7 · sha256:8058b827fc3b0e37… · /containers/cna/references/5
{"name":"https://github.com/saleor/saleor/security/advisories/GHSA-24jw-f244-qfpp","tags":["x_refsource_CONFIRM"],"url":"https://github.com/saleor/saleor/security/advisories/GHSA-24jw-f244-qfpp"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:3eac2eab148e0f3308185fac5e0fef2c2548d1298e8b6c3c40d13b6814d7e6b7 · sha256:8058b827fc3b0e37… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer