Parse Server’s LiveQuery component allows clients to subscribe to real‑time data over WebSockets. Before version 8.6.56 and 9.6.0‑alpha.45 the component ignored the requestComplexity.queryDepth configuration. An attacker can submit a subscription query that nests logical operators to a depth that exceeds the configured limit, forcing the server to recurse deeply and consume excessive CPU resources. This results in service degradation or unavailability for legitimate users. The vulnerability is a severe denial‑of‑service flaw (CWE‑674).

The affected product is the open‑source Parse Server developed by parse-community. The vulnerability applies to all runs of Parse Server before version 8.6.56 and prior to the 9.6.0‑alpha.45 release. The patch is included in those two releases and later versions. Update to a patched version to eliminate the problem.

The CVSS score is 8.2, indicating high severity. The EPSS score is below 1 %, suggesting exploitation is unlikely but still possible. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to send a crafted WebSocket subscription carrying deeply nested logical operators, which is inferred from the description. The attack can be carried out over any publicly reachable WebSocket endpoint that hosts LiveQuery, so best practice is to keep the service updated and/or restrict or disable LiveQuery when not needed.