CVE-2026-1171: 
NixOS vulnerability analysis and mitigation

CVE-2026-1171 is a denial-of-service (DoS) vulnerability in birkir/prime, an open-source self-hosted headless GraphQL CMS. The flaw exists in the GraphQL Field Handler component at the /graphql endpoint and affects all versions up to and including 0.4.0.beta.0 (CPE: cpe:2.3:a:birkir:prime:*:*:*:*:*:*:*:* up to 0.4.0). It was first reported via a GitHub issue on January 3, 2026, and published to NVD on January 19, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) per NIST NVD, while the CNA (VulDB) rates it 5.3 (Medium) under CVSS v3.1 and 5.5 (Medium) under CVSS v4.0 (GitHub Issue, Red Hat CVE).

The root cause is classified as CWE-404 (Improper Resource Shutdown or Release), manifesting as a GraphQL field duplication vulnerability. The GraphQL specification permits the same field to be requested multiple times within a single query, and prime's implementation executes the resolver for each repeated field occurrence without deduplication or rate limiting — resulting in an amplification of database queries or computations per request. An attacker can craft a single HTTP POST request to /graphql containing hundreds of duplicate field references (e.g., __typename repeated hundreds of times), causing the server to perform a disproportionate amount of work. No authentication, special privileges, or user interaction is required. A public proof-of-concept exploit demonstrating this technique was published in the GitHub issue report (GitHub Issue).

Successful exploitation results in a denial-of-service condition, degrading or completely disrupting the availability of the prime CMS instance. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Because prime serves as a headless CMS backend, disruption of the /graphql endpoint would render content unavailable to all dependent frontend applications and consumers of the API (GitHub Issue, Red Hat CVE).

A proof-of-concept exploit is publicly available in the GitHub issue tracker, consisting of a curl command that sends a crafted JSON payload with hundreds of duplicate __typename fields to the /graphql endpoint. The attack requires no authentication and has low complexity, making it trivially reproducible. The EPSS score is approximately 0.039% (low probability of exploitation in the wild), and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the time of reporting. The project maintainer had not responded to the disclosure as of the publication date (GitHub Issue, Red Hat CVE).

1. Reconnaissance: Identify internet-facing instances of birkir/prime CMS (versions ≤ 0.4.0.beta.0) by searching for exposed /graphql endpoints using tools like Shodan or Censys, or by fingerprinting the GraphQL CMS via introspection queries.
2. Craft malicious payload: Construct a JSON GraphQL query body containing a single operation with hundreds or thousands of duplicate field references (e.g., __typename repeated 500+ times) to maximize resolver amplification.
3. Send the request: Submit an HTTP POST request to the target's /graphql endpoint with the crafted payload, as demonstrated in the public PoC:

curl -X POST -H "Content-Type: application/json" \
  -d '{"query": "query cop { __typename \n__typename \n__typename ... (repeated 500+ times) }", "operationName": "cop"}' \
  'http://<target>/graphql'

4. Amplify the attack: Send multiple concurrent requests to compound the server load, exhausting CPU and database connection resources.
5. Achieve DoS: The server becomes unresponsive or severely degraded as it attempts to resolve each duplicated field, denying service to legitimate users (GitHub Issue).

• Network: High volume of HTTP POST requests to /graphql from a single or small set of source IPs; unusually large request body sizes (multi-kilobyte JSON payloads) to the GraphQL endpoint.
• Logs: Web server or application logs showing repeated POST requests to /graphql with Content-Length values in the thousands (e.g., 6551 bytes as in the PoC); requests with User-Agent: oxpecker (used in the published PoC).
• Application Behavior: Sudden spike in database query volume or CPU utilization coinciding with GraphQL requests; increased response latency or timeouts on the /graphql endpoint.
• Process: Elevated database process activity (e.g., PostgreSQL or MySQL) with many near-identical queries executing in rapid succession (GitHub Issue).

No official patched release from the maintainer has been confirmed, as the project had not responded to the disclosure at time of publication. Organizations should apply the following mitigations: (1) Upgrade to a version of birkir/prime beyond 0.4.0.beta.0 if a patched release becomes available; (2) Implement a GraphQL query complexity or depth limiting library (e.g., graphql-query-complexity or graphql-depth-limit) to reject queries exceeding a defined threshold; (3) Apply network-level controls (WAF rules, rate limiting) to restrict access to the /graphql endpoint to trusted clients only; (4) Monitor for anomalous GraphQL request patterns as described in the IOCs section (GitHub Issue, Red Hat CVE).

Red Hat has tracked this vulnerability in their security advisory database, indicating awareness among enterprise Linux vendors (Red Hat CVE). A security advisory was published by zast.ai covering unpatched vulnerabilities in Prime's GraphQL implementation (zast.ai Advisory). The vulnerability was also picked up by automated threat intelligence aggregators including vulners.com, cvefeed.io, and radar.offseq.com shortly after disclosure. Community reaction has been limited, consistent with the niche adoption of the birkir/prime project.