A flaw in the unknown function of birkir prime’s GraphQL Array Based Query Batch handler in the /graphql component allows an attacker to trigger a denial of service by manipulating query requests. The vulnerability is exploitable remotely and a public exploit has been disclosed, enabling attackers to inject crafted queries that cause the server to consume excessive resources and become unresponsive. The primary impact is the loss of service availability for users interfacing with the GraphQL API.

The vulnerability affects the birkir prime application, specifically versions up to and including 0.4.0.beta.0. No other versions were identified as affected. The product is distributed under the birkir:prime package name and resides in the GraphQL module of the codebase.

The CVSS score of 6.9 indicates a medium‑to‑high severity, while the EPSS score of less than 1% reflects a low probability of widespread exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, and the exploit requires remote access to the GraphQL endpoint. If an attacker can craft large or repeated batch queries, the server’s resources can be exhausted, leading to service interruption or crashes. The impact is limited to availability, with no known effects on confidentiality or integrity. The attack vector is inferred to be remote HTTP traffic to the GraphQL endpoint, as the description specifies that the attack can be executed remotely.