CVE-2021-47713: 
Hasura vulnerability analysis and mitigation

CVE-2021-47713 is a denial-of-service (DoS) vulnerability in Hasura GraphQL Engine version 1.3.3 that allows unauthenticated remote attackers to crash the GraphQL endpoint by submitting malicious queries with excessively nested fields and extremely long query strings. The vulnerability was published on December 22, 2025, and is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (VulnCheck Advisory, Feedly).

The root cause is CWE-770 — the Hasura GraphQL Engine 1.3.3 does not impose limits on query depth, complexity, or string length, allowing resource exhaustion through crafted inputs. An attacker can exploit this by sending HTTP POST requests containing deeply nested GraphQL field structures and extremely long query strings, optionally using multiple concurrent threads to amplify resource consumption. No authentication or special privileges are required, and no user interaction is needed, making this trivially exploitable over the network. A public proof-of-concept exploit is available on Exploit-DB (Exploit-DB PoC, VulnCheck Advisory).

Successful exploitation results in high availability impact — the GraphQL endpoint can be crashed or rendered unresponsive, denying service to legitimate users. There is no confidentiality or integrity impact associated with this vulnerability. Affected deployments relying on Hasura GraphQL Engine 1.3.3 as a data API layer may experience complete service outages, disrupting downstream applications and users (VulnCheck Advisory, Feedly).

A public proof-of-concept exploit is available on Exploit-DB (exploit ID 49789), and a VulnCheck advisory documents the attack technique. The EPSS score is approximately 0.038%, indicating a low but non-zero probability of exploitation in the wild. There is currently no evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Exploit-DB PoC, VulnCheck Advisory).

1. Reconnaissance: Identify internet-facing Hasura GraphQL Engine instances running version 1.3.3 using tools like Shodan or Censys, searching for the Hasura console or GraphQL endpoint (typically /v1/graphql).
2. Craft malicious query: Construct a GraphQL query with deeply nested fields (e.g., objects nested dozens or hundreds of levels deep) and/or an extremely long query string to maximize server-side parsing and computation cost.
3. Multi-threaded request flood: Use a scripting tool (e.g., Python requests with concurrent.futures, or tools like wrk) to send the crafted query repeatedly across multiple threads simultaneously, amplifying resource consumption.
4. Exhaust server resources: The server's CPU and memory are consumed processing the malformed queries, causing the GraphQL endpoint to become unresponsive or crash, denying service to legitimate users (Exploit-DB PoC, VulnCheck Advisory).

• Network: Unusually high volume of HTTP POST requests to /v1/graphql from one or few source IPs; requests with abnormally large body sizes or extremely long query strings.
• Logs: Hasura server logs showing repeated complex or deeply nested query parsing; error logs indicating memory exhaustion or process crashes; access logs with high request rates from single sources.
• Process: Hasura GraphQL Engine process consuming abnormally high CPU or memory; process restarts or crashes correlating with bursts of inbound requests.
• Application: GraphQL endpoint returning 503/timeout errors or becoming completely unresponsive during or after a burst of requests (VulnCheck Advisory).

The patch availability for Hasura GraphQL Engine 1.3.3 is currently unconfirmed; users should upgrade to the latest available version of Hasura GraphQL Engine and consult Hasura support for specific guidance (Hasura GitHub). As immediate workarounds, operators should implement GraphQL query depth and complexity limits at the API gateway or middleware layer, enforce rate limiting on the GraphQL endpoint, and validate/reject queries exceeding defined size thresholds. Temporarily restricting access to the GraphQL endpoint to trusted IP ranges and monitoring for anomalous query patterns are also recommended interim measures (VulnCheck Advisory, Feedly).