An unauthenticated resource exhaustion vulnerability in Saleor allows remote attackers to trigger denial of service conditions by bypassing GraphQL query complexity limits.

This is a resource exhaustion flaw (CWE-770) occurring within the GraphQL query batching implementation, where the application fails to enforce an upper limit on the number of operations per request. An unauthenticated attacker can submit a JSON array containing a large number of operations to bypass per-query complexity protections, leading to application instability or service outages.

Successful exploitation results in a denial of service, which can significantly disrupt e-commerce operations, prevent customer transactions, and lead to revenue loss. With a CVSS score of 7.5, the vulnerability is classified as High severity, reflecting the ease of exploitation by unauthenticated remote actors and the significant impact on system availability.

Immediate Action: Update to the fixed versions: 3.20.118, 3.21.54, 3.22.47, or 3.23.0a3, as appropriate for your specific deployment branch.

Proactive Monitoring: Monitor server resource utilization, specifically CPU and memory spikes, alongside web access logs for abnormally large or frequent GraphQL batch requests from single IP addresses.

Compensating Controls: Implement rate limiting at the Web Application Firewall (WAF) or API gateway layer to restrict the size and frequency of JSON payloads submitted to the GraphQL endpoint.

Public Exploit Available: No (Exploit_available: false)

Given the high impact of a potential denial of service on e-commerce platforms, organizations should prioritize upgrading their Saleor instances to the patched versions. If an immediate patch is not feasible, deploying strict request size limits at the network edge is essential to prevent unauthorized resource exhaustion.