GHSA-h9mw-h4qc-f5jf

**CVSS 6.5 Medium** — The GraphQL API served by kubernetes-graphql-gateway is vulnerable to Denial-of-Service (DoS) attacks due to a complete absence of query resource controls (depth limiting, complexity analysis, response size capping, and rate limiting). An authenticated attacker can craft queries that force the server to compute and serialize multi-megabyte responses, consuming significant CPU, memory, and network bandwidth. Repeated requests can exhaust server resources and degrade or deny service to legitimate users. > **Note:** A previous version of this advisory (based on pre-v1 code) documented an unauthenticated attack surface via an HTTP GET method bypass in the former `registry.go`. That bypass has been removed in v1 — all requests now require a Bearer token. The CVSS score has been adjusted from 7.5 to 6.5 accordingly (Privileges Required: None → Low). CWE-306 (Missing Authentication for Critical Function) no longer applies. ## Root Cause The kubernetes-graphql-gateway uses the `graphql-go/graphql` library (v0.8.1) with the `graphql-go/handler` HTTP handler. The handler is instantiated in `gateway/gateway/graphql/graphql.go` with only cosmetic configuration — no resource limits: ```go // gateway/gateway/graphql/graphql.go — CreateHandler() func (s *GraphQLServer) CreateHandler(schema *graphql.Schema) *GraphQLHandler { graphqlHandler := handler.New(&handler.Config{ Schema: schema, Pretty: s.config.Pretty, Playground: s.config.Playground, GraphiQL: s.config.GraphiQL, }) return &GraphQLHandler{ Schema: schema, Handler: graphqlHandler, } } ``` The `handler.Config` struct does not include `MaxDepth`, `MaxComplexity`, `MaxResponseSize`, or any equivalent fields. Neither the `graphql-go/handler` nor the underlying `graphql-go/graphql` library provides built-in query depth or complexity analysis. The application configuration (`gateway/gateway/config/config.go`) has no fields for r