CVE-2026-119701
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails
CVSS
5.3
Média
EPSS
0.6%
p48
KEV
—
Exploit Today
15
0-100
Publicado: 30 de out. de 2026 · Última mod.: 30 de out. de 2026 · CWE-770
0.6%EPSS · 30 dias0.6%
2026-10-312026-11-07
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batch_limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.
- github.comhttps://github.com/wp-graphql/wp-graphql
- github.comhttps://github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/SendPasswordResetEmail.php
- github.comhttps://github.com/wp-graphql/wp-graphql/commit/760db555e3e60fbd86c1d96f1689bacfc9265592
- github.comhttps://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.24.1
- github.comhttps://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-f5f8-v768-93c8
- www.vulncheck.comhttps://www.vulncheck.com/advisories/wpgraphql-before-2.24.1-email-flooding-via-aliased-sendpasswordresetemail-mutations
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1236103.7 BAI—
———rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request.7hCVE-2026-1235777.5 ALT—
———Hickory DNS from 0.24.0 before 0.26.2 contains a resource exhaustion vulnerability that allows remote attackers to consume server memory via unbounded DoH request bodies. Attackers can send large request bodies over HTTP/2 or HTTP/3 to a DNS over HTTP server, causing memory exhaustion and denial of service.7hCVE-2026-1235767.5 ALT—
———Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server resources by sending incomplete DNS-over-QUIC request bodies. Attackers can open many connections and send only large length prefixes, causing pre-allocated buffers to persist without timeout and exhausting server memory.7hCVE-2026-1235757.5 ALT—
———Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or limits for incomplete request bodies. Remote attackers can open DoH connections, send incomplete request bodies, and hold connections open to exhaust server memory.7hCVE-2026-1235697.5 ALT—
———The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not allow, and serialized there can cause a denial of service.7hCVE-2026-1235647.5 ALT—
———Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array serialized by an application can exhaust memory in the browser or runtime evaluating the output.7h