CVE-2026-64861

MEDIUM 4.3

Probo: GraphQL Alias-Based Application Layer Denial of Service (DoS)

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.222.0, the GraphQL endpoint does not enforce restrictions on alias count, query depth, or query complexity. An attacker can send a single request containing thousands of aliased resolver calls, causing excessive server-side resource consumption and service degradation. This issue has been patched in version 0.222.0.

CWE	CWE-770
Vendor	getprobo
Product	probo
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for getprobo probo

Be the first to know when new medium vulnerabilities affecting getprobo probo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

getprobo / probo

< 0.222.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/getprobo/probo/security/advisories/GHSA-prh2-g8pv-m7p9 github.com: https://github.com/getprobo/probo/pull/1424 github.com: https://github.com/getprobo/probo/commit/bf255b198cb6c9f44cd183c49743c9ffdaa44ce7 github.com: https://github.com/getprobo/probo/releases/tag/probod%2Fv0.222.0