The vulnerability originates in the coerceString and coerceBool functions of the graphql-go library, which accept scalar values whose runtime type does not match the declared GraphQL scalar type. This lack of strict type validation permits a client to submit a request containing values such as an unexpected nested structure or an object where a string or boolean is expected. As a result, when the library attempts to process such input it may access memory incorrectly, leading to a stack overflow and a fatal error that crashes the application. The issue aligns with CWE‑1287, describing improper contract validation and type confusion.

The issue exists in the graphql-go project:graphql-go library, affecting all releases up to and including version 0.8.1. This library is used to build GraphQL servers in Go, so any application that processes user‑supplied GraphQL queries and relies on this vulnerable version is at risk.

With a CVSS score of 5.9, the vulnerability falls into the medium severity range. Exploitation requires an attacker to send a specially crafted GraphQL payload, so the likelihood is moderate but not high; EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, indicating it is not currently a high‑profile target. Nevertheless, the stack overflow can cause a denial of service and, depending on the hosting environment, could enable further instability or compromise if the program enters undefined behavior. The attack vector is remote over the network through a GraphQL endpoint.