Directus GraphQL alias amplification allows an authenticated user to repeat costly relational queries many times in a single request. By exploiting aliasing, the server executes a linear number of independent complex database queries, multiplying CPU, memory and I/O load. The result is a denial of service that can degrade or crash the service only through resource exhaustion. This weakness is classified as Unbounded Input and Memory Allocation.

The vulnerability affects Directus installations running any version prior to 11.17.0. Users of Directus product by the Directus vendor are impacted. The issue exists within the GraphQL endpoints (/graphql and /graphql/system).

The CVSS score of 6.5 indicates medium severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no publicly known exploit yet. Attackers need only authenticated access, even with minimal read‑only permissions, to trigger the denial of service by sending a crafted GraphQL request with a large number of aliases. The lack of rate limiting and token limit insufficiency make exploitation straightforward under these conditions.