AIKIDO-2026-187797
graphql-c_parser is vulnerable to Use-After-Free
98
Critical Risk
This Affects:
graphql-c_parserTL;DR
graphql-c_parser parses GraphQL documents for GraphQL-Ruby using a Bison-generated parser. While relocating AST nodes to heap memory during parsing, Ruby's garbage collector cannot see that region and can free the objects mid parse, after which the parser keeps using the freed memory. Parsing untrusted GraphQL input can therefore corrupt memory, leading to crashes or potential code execution. The fix configures Bison with YYSTACK_USE_ALLOCA 1 so the parser uses stack memory.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application parses untrusted GraphQL documents.
Background info
graphql-c_parser is vulnerable to Use-After-Free in versions 0.0.1 - 1.1.3.
How to fix this
Upgrade the graphql-c_parser library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant