Filtered by vendor Ohler Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-30288 1 Ohler 1 Agoo 2024-08-22 7.5 High
Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors.
CVE-2020-7670 1 Ohler 1 Agoo 2024-08-04 7.5 High
agoo prior to 2.14.0 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks where `agoo` is used as part of a chain of backend servers due to insufficient `Content-Length` and `Transfer Encoding` parsing.