Unauthenticated attackers can trigger a denial of service condition in Saleor by submitting malicious GraphQL requests that exhaust system resources.

The application fails to implement adequate throttling or limits on GraphQL aliases and chained operations, allowing an unauthenticated attacker to cause resource exhaustion via a single API call.

The vulnerability carries a CVSS score of 7.5, reflecting a significant risk of service disruption. Successful exploitation allows an attacker to crash the e-commerce backend, leading to potential revenue loss, degradation of customer experience, and operational downtime during the period of unavailability.

Immediate Action: Upgrade to versions 3.20.118, 3.21.54, 3.22.47, or 3.23.0a3 as applicable to your current deployment branch.

Proactive Monitoring: Monitor API gateway logs and application metrics for unusual spikes in GraphQL request volume or high latency in processing query aliases.

Compensating Controls: Implement rate limiting and depth analysis at the Web Application Firewall (WAF) or API gateway layer to block overly complex or recursive GraphQL queries.

Public Exploit Available: No (exploit_available: unknown)

Given the high impact on service availability, organizations should prioritize patching their Saleor instances immediately. If an immediate update is not feasible, apply strict request validation and query complexity limits at the network edge to prevent exploitation while planning for the maintenance window.