StackRadar

CVE-2023-49559

Medium

Advisory

Published 12 Jun 2024In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.006
47th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
23
of 17,781 indexed, latest versions
Container images
23
deployed by those charts
Fix available
2 of 2
affected packages

gqlparser denial of service vulnerability via the parserDirectives function

Carried by container images the latest versions of 23 of 17,781 indexed charts deploy, on 23 images.

Affected packageAffected versionsFixed inImages
github.com/vektah/gqlparser/v2golangv2.0.1, v2.1.0, v2.4.0, v2.4.1+10 more2.5.1421
github.com/vektah/gqlparsergolangv1.0.0, v1.1.22.5.142
OSV records
GHSA-2hmf-46v7-v6fx
Also known as
GO-2024-2920

Charts affected

23 by stars
ChartLatestAffected imagesRadar Score
gboxgboxVerified publisher1.0.51 of 2See more

gbox gbox 1.0.5

1 of the 2 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
gboxproxy/gbox:v1.0.63a9f4a711d5c
github.com/vektah/gqlparser/v2@v2.4.0
2.5.14

Open the chart page →

2,521
stashgeek-cookbookVerified publisher3.4.21 of 1See more

stash geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
stashapp/stash:latest24dbd7607174
github.com/vektah/gqlparser/v2@v2.0.1
2.5.14

Open the chart page →

15,856
mesherykubesphere-stable0.5.01 of 13See more

meshery kubesphere-stable 0.5.0

1 of the 13 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
layer5/meshery:stable-latest78a8be21bef3
github.com/vektah/gqlparser/v2@v2.5.11
2.5.14

Open the chart page →

24,690
goalerttokens-studioVerified publisher0.0.51 of 2See more

goalert tokens-studio 0.0.5

1 of the 2 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
goalert/goalert:v0.32.008d57388b0cb
github.com/vektah/gqlparser/v2@v2.5.11
2.5.14

Open the chart page →

1,469
clechaosnative0.2.71 of 6See more

cle chaosnative 0.2.7

1 of the 6 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
chaosnative/cle-server:2.7.0e7bcff4a20c0
github.com/vektah/gqlparser/v2@v2.0.1
2.5.14

Open the chart page →

16,389
degafactlyVerified publisher0.11.131 of 3See more

dega factly 0.11.13

1 of the 3 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
factly/dega-api:0.15.166fafc7b0a17
github.com/vektah/gqlparser/v2@v2.1.0
2.5.14

Open the chart page →

5,747
kiaekiae0.1.61 of 9See more

kiae kiae 0.1.6

1 of the 9 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
ghcr.io/kiaedev/kiae:latestebd03028ff6a
github.com/vektah/gqlparser/v2@v2.5.0
2.5.14

Open the chart page →

19,168
traggokrzwiatrzyk1.0.01 of 1See more

traggo krzwiatrzyk 1.0.0

1 of the 1 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
traggo/server:0.2.3f1ced637510e
github.com/vektah/gqlparser@v1.1.2
2.5.14

Open the chart page →

1,885
chaos-meshkubeblocksVerified publisher2.7.21 of 4See more

chaos-mesh kubeblocks 2.7.2

1 of the 4 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-mesh:v2.7.28bc853c7414c
github.com/vektah/gqlparser/v2@v2.4.5
2.5.14

Open the chart page →

13,497
testkube-apikubeshop2.1.1621 of 2See more

testkube-api kubeshop 2.1.162

1 of the 2 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
kubeshop/testkube-api-server:2.1.162e97dc620d9b4
github.com/vektah/gqlparser/v2@v2.5.2-0.20230422221642-25e09f9d292d
2.5.14

Open the chart page →

1,663
harborkubesphereVerified publisher1.9.31 of 11See more

harbor kubesphere 1.9.3

1 of the 11 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
github.com/vektah/gqlparser/v2@v2.4.4
2.5.14

Open the chart page →

17,798
chaos-meshkubesphere-stable2.5.11 of 3See more

chaos-mesh kubesphere-stable 2.5.1

1 of the 3 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-mesh:v2.5.1700bb42ac21d
github.com/vektah/gqlparser/v2@v2.4.1
2.5.14

Open the chart page →

8,555
iomeshkubesphere-stable1.1.01 of 25See more

iomesh kubesphere-stable 1.1.0

1 of the 25 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
iomesh/deck:v0.1.0a31e26b6ae22
github.com/vektah/gqlparser/v2@v2.5.10
2.5.14

Open the chart page →

48,665
IOMeshkubesphere-stable1.2.01 of 25See more

IOMesh kubesphere-stable 1.2.0

1 of the 25 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
iomesh/deck:v0.2.0282d6c419ed3
github.com/vektah/gqlparser/v2@v2.5.10
2.5.14

Open the chart page →

46,341
trivy-serverlemontechVerified publisher0.1.01 of 1See more

trivy-server lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
aquasec/trivy:0.32.0973d0df16189
github.com/vektah/gqlparser/v2@v2.4.6
2.5.14

Open the chart page →

4,271
devspace-cloudloftVerified publisher0.3.31 of 8See more

devspace-cloud loft 0.3.3

1 of the 8 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
devspacecloud/manager:0.3.349c397413f7b
github.com/vektah/gqlparser@v1.0.0
2.5.14

Open the chart page →

9,880
datastorerookout0.1.481 of 1See more

datastore rookout 0.1.48

1 of the 1 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
rookout/data-on-prem:latest51c0fce64467
github.com/vektah/gqlparser/v2@v2.4.2
2.5.14

Open the chart page →

1,941
rookout-hybridrookout0.3.11 of 2See more

rookout-hybrid rookout 0.3.1

1 of the 2 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
rookout/data-on-prem:latest51c0fce64467
github.com/vektah/gqlparser/v2@v2.4.2
2.5.14

Open the chart page →

3,901
agentssynapse0.1.302 of 9See more

agents synapse 0.1.30

2 of the 9 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/agents:6e3887fc2a05aff0d159453cedbfbe5024b910bf81a9ebc899a4
github.com/vektah/gqlparser/v2@v2.5.1
2.5.14
ghcr.io/synapsecns/sanguine/scribe:6e3887fc2a05aff0d159453cedbfbe5024b910bf5e0a3dfa9f96
github.com/vektah/gqlparser/v2@v2.5.1
2.5.14

Open the chart page →

7,244
cctpsynapse0.3.01 of 4See more

cctp synapse 0.3.0

1 of the 4 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/cctp-relayer:b5a1dd5288f1a18eb05994e130d626fed45a56fc2f1408c94168
github.com/vektah/gqlparser/v2@v2.5.1
2.5.14

Open the chart page →

1,815
promexportersynapse0.1.11 of 1See more

promexporter synapse 0.1.1

1 of the 1 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/promexporter:4a9aad096c2bd1160e56e5472ddac77fa0cde2e9416c1c5aeb86
github.com/vektah/gqlparser/v2@v2.5.1
2.5.14

Open the chart page →

1,704
sinnersynapse0.1.01 of 6See more

sinner synapse 0.1.0

1 of the 6 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/sinner:latest3e98a98f6074
github.com/vektah/gqlparser/v2@v2.5.8
2.5.14

Open the chart page →

1,955
twitter-apptwitter-helm0.1.121 of 8See more

twitter-app twitter-helm 0.1.12

1 of the 8 container images this version deploys carry CVE-2023-49559.

Container imageDigestPackageFixed in
stakkato95/twitter-service-graphql:0.1.13cbe857234f2
github.com/vektah/gqlparser/v2@v2.4.2
2.5.14

Open the chart page →

6,132

Container images carrying it

23 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
rookout/data-on-prem:latest51c0fce64467
github.com/vektah/gqlparser/v2@v2.4.2
2.5.14
2
aquasec/trivy:0.32.0973d0df16189
github.com/vektah/gqlparser/v2@v2.4.6
2.5.14
1
chaosnative/cle-server:2.7.0e7bcff4a20c0
github.com/vektah/gqlparser/v2@v2.0.1
2.5.14
1
devspacecloud/manager:0.3.349c397413f7b
github.com/vektah/gqlparser@v1.0.0
2.5.14
1
factly/dega-api:0.15.166fafc7b0a17
github.com/vektah/gqlparser/v2@v2.1.0
2.5.14
1
gboxproxy/gbox:v1.0.63a9f4a711d5c
github.com/vektah/gqlparser/v2@v2.4.0
2.5.14
1
goalert/goalert:v0.32.008d57388b0cb
github.com/vektah/gqlparser/v2@v2.5.11
2.5.14
1
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
github.com/vektah/gqlparser/v2@v2.4.4
2.5.14
1
iomesh/deck:v0.2.0282d6c419ed3
github.com/vektah/gqlparser/v2@v2.5.10
2.5.14
1
iomesh/deck:v0.1.0a31e26b6ae22
github.com/vektah/gqlparser/v2@v2.5.10
2.5.14
1
kubeshop/testkube-api-server:2.1.162e97dc620d9b4
github.com/vektah/gqlparser/v2@v2.5.2-0.20230422221642-25e09f9d292d
2.5.14
1
layer5/meshery:stable-latest78a8be21bef3
github.com/vektah/gqlparser/v2@v2.5.11
2.5.14
1
stakkato95/twitter-service-graphql:0.1.13cbe857234f2
github.com/vektah/gqlparser/v2@v2.4.2
2.5.14
1
stashapp/stash:latest24dbd7607174
github.com/vektah/gqlparser/v2@v2.0.1
2.5.14
1
traggo/server:0.2.3f1ced637510e
github.com/vektah/gqlparser@v1.1.2
2.5.14
1
ghcr.io/chaos-mesh/chaos-mesh:v2.5.1700bb42ac21d
github.com/vektah/gqlparser/v2@v2.4.1
2.5.14
1
ghcr.io/chaos-mesh/chaos-mesh:v2.7.28bc853c7414c
github.com/vektah/gqlparser/v2@v2.4.5
2.5.14
1
ghcr.io/kiaedev/kiae:latestebd03028ff6a
github.com/vektah/gqlparser/v2@v2.5.0
2.5.14
1
ghcr.io/synapsecns/sanguine/agents:6e3887fc2a05aff0d159453cedbfbe5024b910bf81a9ebc899a4
github.com/vektah/gqlparser/v2@v2.5.1
2.5.14
1
ghcr.io/synapsecns/sanguine/cctp-relayer:b5a1dd5288f1a18eb05994e130d626fed45a56fc2f1408c94168
github.com/vektah/gqlparser/v2@v2.5.1
2.5.14
1
ghcr.io/synapsecns/sanguine/promexporter:4a9aad096c2bd1160e56e5472ddac77fa0cde2e9416c1c5aeb86
github.com/vektah/gqlparser/v2@v2.5.1
2.5.14
1
ghcr.io/synapsecns/sanguine/scribe:6e3887fc2a05aff0d159453cedbfbe5024b910bf5e0a3dfa9f96
github.com/vektah/gqlparser/v2@v2.5.1
2.5.14
1
ghcr.io/synapsecns/sanguine/sinner:latest3e98a98f6074
github.com/vektah/gqlparser/v2@v2.5.8
2.5.14
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.