Denial of Service: GraphQL

An attacker can trigger excessive CPU and memory usage by crafting expensive nested GraphQL queries to cause Denial of Service (DoS).

The GraphQL query language for APIs provides a runtime to query existing data. GraphQL schema is a model consisting of data objects their fields and types, and their relationships to other data objects. References between different data objects might create a cycle. An attacker can trigger excessive CPU and memory usage by crafting a malicious nested and expensive cyclic query to cause a Denial of Service (DoS).

For example, consider this GraphQL schema snippet:

…
type User {
  id: ID!
  name: String
  profile: Profile
}
type Profile {
  id: ID!
  bio: String
  user: User
  preferences: Preferences
}
type Preferences {
  id: ID!
  theme: String
  user: User
}
…

In this example, User references Profile, Profile references Preferences, and Preferences references back to User creating a cycle.
A sample query to create a cycle:

query {
  user(id:1) {
    id
    name
    profile {
      id
      bio
      preferences {
        id
        theme
        user {
          name
        }        
      }
    }
  }
}