CVE-2024-40094

Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days.

GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.

Published 2024-07-30. Last modified 2026-06-17.