NRDAX-T0096 - GraphQL Nested Query Depth CPU Exhaustion

Pending classification · active · first seen 2026-07-21

Producer label: compute_amp. Not yet assigned a mechanism family.

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

go-ethereum#32344 (geth graphql): a single unauthenticated HTTP POST to /graphql carrying a deeply-nested query `{block{ommers{ommers{...}}}}` is parsed with unbounded nesting depth by graph-gophers/graphql-go; a sufficiently deep query (~1e6 levels) drives recursive-descent parsing past Go's 1 GiB goroutine-stack limit -> `fatal error: stack overflow` -> the geth process crashes (remote DoS). Verified live vs a pre-fix geth (commit dffa1f51): depth 1e6 kills the node. Fixed by graphql.MaxDepth(20). https://github.com/ethereum/go-ethereum/pull/32344

live exposure

No exposure data. Slashr ↗ has no risk signal mapped to this technique yet — absence of data is not absence of exposure.

instances (1)

chain	primitive	fidelity	origin	reproducer (bundle)	source
ethereum	geth_graphql_query_depth_stack_overflow	lab	reverse-engineered-cve	geth_graphql_query_depth_stack_overflow	-

references

vendor-advisory: GHPR-ethereum-go-ethereum-32344

cite

https://nrdax.com/techniques/NRDAX-T0096

plain

NRDAX Registry. Technique NRDAX-T0096.

bibtex

@misc{nrdax_NRDAX_T0096,
  title = {GraphQL Nested Query Depth CPU Exhaustion (NRDAX-T0096)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0096},
}

json (csl)

{
  "id": "nrdax-NRDAX-T0096",
  "type": "dataset",
  "title": "GraphQL Nested Query Depth CPU Exhaustion (NRDAX-T0096)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0096",
  "publisher": "NRDAX Registry"
}

badge

[![NRDAX-T0096 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0096.svg)](https://nrdax.com/techniques/NRDAX-T0096-graphql-nested-query-depth-cpu-exhaustion)

use from the CLI

Retrieve or cite this technique from a script or the terminal with the NRDAX Python library & CLI.

Retrieve this technique

nrdax get NRDAX-T0096

Cite it (BibTeX)

nrdax cite NRDAX-T0096 --format bibtex

CLI guide → GitHub ↗