VYPR
← All advisories
High severity7.5NVD Advisory· Published Apr 8, 2026· Updated Apr 20, 2026

CVE-2026-33756

CVE-2026-33756

Description

Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL operations in a single HTTP request as a JSON array but wasn't enforcing any upper limit on the number of operations. This allowed an unauthenticated attacker to send a single HTTP request many operations (bypassing the per query complexity limit) to exhaust resources. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

Affected products

4
  • Saleor/Saleor4 versions
    cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*range: >=2.0.0,<3.20.118
    • cpe:2.3:a:saleor:saleor:3.23.0:alpha0:*:*:*:*:*:*
    • cpe:2.3:a:saleor:saleor:3.23.0:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:saleor:saleor:3.23.0:alpha2:*:*:*:*:*:*

Patches

5
7be352fa8c35
https://github.com/saleor/saleorvia nvd-ref
commit
cdb66da97abb
https://github.com/saleor/saleorvia nvd-ref
commit
d6a94e95bd77
https://github.com/saleor/saleorvia nvd-ref
commit
e42aa4d6e588
https://github.com/saleor/saleorvia nvd-ref
commit
f0371bdd4caf
https://github.com/saleor/saleorvia nvd-ref
commit

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.