Saleor, an e‑commerce platform, contains a GraphQL resource exhaustion flaw that allows an attacker to send numerous mutations or queries in a single request through aliases or mutation chaining. The flaw enables abuse of server resources, potentially leading to denial of service and compromising availability. The weakness is classified as CWE-770, entitled The system has insufficient total resource limits. The main consequence is that an attacker can exhaust CPU, memory, or other server limits, resulting in service disruption.

Vendors affected are Saleor for the Saleor e‑commerce platform. The issue is present in all releases from 2.0.0 up to just before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118. The vulnerability is remedied by upgrading to 3.23.0a3 or the corresponding patched releases 3.22.47, 3.21.54, or 3.20.118.

With a CVSS score of 7.5, the vulnerability has high severity. The EPSS score is not available and it is not listed in CISA’s KEV catalog, indicating that a documented exploit is not publicly known. According to the description, the most likely attack vector is a remote GraphQL API call over HTTP or HTTPS; an attacker can perform the exploitation simply by sending a crafted request from any external source. No authentication is required beyond having access to the GraphQL endpoint, and the exploitation can be done with unauthenticated or low‑privilege accounts if the API is exposed.