A vulnerability in Hasura GraphQL Engine 1.3.3 allows unauthenticated attackers to trigger a denial of service condition by exhausting server resources.

This is a resource exhaustion vulnerability (CWE-770) caused by the lack of limits or throttling on GraphQL queries. An unauthenticated attacker can send crafted, deeply nested, or excessively long query strings across multiple threads to overwhelm the server.

The exploitation of this vulnerability results in a complete denial of service for the affected GraphQL endpoint. This leads to significant operational downtime, preventing legitimate users from accessing critical data or services, and potentially causing cascading failures in dependent applications. Given the CVSS score of 7.5, this high-severity flaw represents a substantial risk to service availability and business continuity.

Immediate Action: Update the Hasura GraphQL Engine to a patched version that implements query complexity analysis and depth limiting.

Proactive Monitoring: Monitor server resource utilization, specifically CPU and memory spikes, and review access logs for repetitive or unusually large GraphQL query patterns that may indicate an ongoing attack.

Compensating Controls: Deploy a Web Application Firewall (WAF) or a GraphQL-specific security proxy to enforce query depth limits and block requests that exhibit malicious complexity patterns.

Public Exploit Available: Yes, a functional proof-of-concept script exists on Exploit-DB (EDB-ID: 49789).

Organizations running Hasura GraphQL Engine version 1.3.3 must prioritize updating their software to a secure version immediately to prevent potential service disruption. If an immediate update is not feasible, implement strict query depth and complexity limits at the application gateway or WAF level to mitigate the risk of resource exhaustion attacks.