High severity7.5OSV Advisory· Published Oct 3, 2024· Updated Apr 15, 2026

CVE-2024-47614

Description

async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of directives for a field. This can lead to Service Disruption, Resource Exhaustion, and User Experience Degradation. This vulnerability is fixed in 7.0.10.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
async-graphqlcrates.io	< 7.0.10	7.0.10

Affected products

Async Graphql/Async GraphqlOSV
Range: async-graphql-actix-web@1.13.5, async-graphql-actix-web@1.14.0, async-graphql-actix-web@1.14.14, …
ghsa-coords
pkg:cargo/async-graphql
Range: < 7.0.10

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-5gc2-7c65-8fq8ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-47614ghsaADVISORY
github.com/async-graphql/async-graphql/commit/7f1791488463d4e9c5adcd543962173e2f6cbd34nvdWEB
github.com/async-graphql/async-graphql/security/advisories/GHSA-5gc2-7c65-8fq8nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000