CVE-2026-1172
📋 TL;DR
A denial-of-service vulnerability exists in birkir prime's GraphQL Directive Handler component, allowing remote attackers to crash the service via manipulation of the /graphql endpoint. This affects all systems running birkir prime versions up to 0.4.0.beta.0 with GraphQL functionality enabled.
💻 Affected Systems
- birkir prime
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability requiring manual restart, potentially disrupting critical business functions.
Likely Case
Temporary service disruption affecting GraphQL API availability until service restart.
If Mitigated
Minimal impact with proper rate limiting, input validation, and monitoring in place.
🎯 Exploit Status
Exploit details are publicly available in GitHub issue #543; remote exploitation without authentication is possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
No official patch available. Monitor GitHub repository for updates. Consider upgrading to any future patched version when released.
🔧 Temporary Workarounds
Disable GraphQL endpoint
allTemporarily disable the /graphql endpoint if not required for functionality.
# Configuration depends on deployment method. Check application config files for GraphQL settings.
Implement rate limiting
linuxAdd rate limiting to /graphql endpoint to prevent exploitation attempts.
# Use web server (nginx/apache) or application-level rate limiting. Example for nginx:
# limit_req_zone $binary_remote_addr zone=graphql:10m rate=10r/s;
# location /graphql { limit_req zone=graphql burst=20; }
🧯 If You Can't Patch
- Implement network-level controls to restrict access to /graphql endpoint to trusted sources only.
- Deploy Web Application Firewall (WAF) with GraphQL-specific protections and DoS mitigation rules.
🔍 How to Verify
Check if Vulnerable:
Check if running birkir prime version ≤ 0.4.0.beta.0 with GraphQL enabled and /graphql endpoint accessible.Check Version:
# Check package version: dpkg -l | grep prime or rpm -qa | grep prime
# Or check application configuration files for version information.Verify Fix Applied:
Verify upgrade to version > 0.4.0.beta.0 when available, or confirm GraphQL endpoint is disabled/protected.📡 Detection & Monitoring
Log Indicators:
- Unusual volume of requests to /graphql endpoint
- Application crash logs mentioning GraphQL directive handler
- Error logs containing stack traces from GraphQL component
Network Indicators:
- High volume of requests to /graphql endpoint from single/multiple sources
- Abnormal request patterns to GraphQL API
SIEM Query:
source="*app.log*" AND ("/graphql" OR "GraphQL") AND (error OR crash OR exception)