CVE-2026-1173
📋 TL;DR
A denial-of-service vulnerability exists in birkir prime's GraphQL array-based query batch handler. Attackers can remotely exploit this by sending specially crafted GraphQL queries to the /graphql endpoint, causing service disruption. Systems running birkir prime versions up to 0.4.0.beta.0 are affected.
💻 Affected Systems
- birkir prime
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability requiring system restart, potentially affecting all users and dependent services.
Likely Case
Temporary service degradation or crashes affecting user experience and application availability.
If Mitigated
Minimal impact with proper rate limiting, query validation, and monitoring in place.
🎯 Exploit Status
Exploit details are publicly available and can be executed remotely without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Implement GraphQL Query Limits
allAdd query depth/complexity limits and rate limiting to prevent DoS attacks
# Configure in your GraphQL server settings
# Example for graphql-ruby: max_depth: 10, max_complexity: 100
Restrict GraphQL Endpoint Access
linuxLimit access to /graphql endpoint using firewall rules or authentication
# Example iptables rule: iptables -A INPUT -p tcp --dport 80 -m string --string "/graphql" --algo bm -j DROP
# Or use web server configuration to restrict access
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block suspicious GraphQL queries
- Monitor GraphQL endpoint traffic for abnormal patterns and implement automated blocking
🔍 How to Verify
Check if Vulnerable:
Check if running birkir prime version ≤ 0.4.0.beta.0 and GraphQL endpoint is accessibleCheck Version:
Check package.json or application configuration for birkir prime versionVerify Fix Applied:
Test with known exploit payloads to ensure service remains available📡 Detection & Monitoring
Log Indicators:
- Multiple rapid requests to /graphql endpoint
- Application crashes or high CPU/memory usage
- Error logs containing GraphQL parsing failures
Network Indicators:
- Unusually large GraphQL query payloads
- High volume of requests to /graphql endpoint
- Traffic patterns suggesting automated exploitation
SIEM Query:
source="web_server" AND (uri_path="/graphql" AND (request_size>10000 OR request_count>100/minute))