CVE-2026-80051

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions (scalars.go) accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising the request error that the GraphQL specification mandates. In some cases (but not any typical case of JSON sent to a website), a deeply nested value leads to an unrecoverable "fatal error: stack overflow" condition.

CWE	CWE-1287
Vendor	graphql-go project
Product	graphql-go
Published	Aug 25, 2026

Stay Ahead of the Next One

Get instant alerts for graphql-go project graphql-go

Be the first to know when new unknown vulnerabilities affecting graphql-go project graphql-go are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

graphql-go project / graphql-go

0 ≤ 0.8.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/graphql-go/graphql/blob/v0.8.1/scalars.go#L307-L315 openwall.com: https://www.openwall.com/lists/oss-security/2026/08/25/2