CVE-2026-1173: 
NixOS vulnerability analysis and mitigation

CVE-2026-1173 is a denial-of-service (DoS) vulnerability in the GraphQL Array Based Query Batch Handler of birkir/prime, an open-source self-hosted headless CMS. The vulnerability affects all versions of prime up to and including 0.4.0 (including 0.4.0.beta.0). It was reported via a GitHub issue on January 3, 2026, and published to NVD on January 19, 2026. The CNA (VulDB) assigned a CVSS v3.1 score of 5.3 (Medium), while NIST's NVD enrichment assigned a CVSS v3.1 score of 9.8 (Critical); the CVSS v4.0 score is 5.5 (Medium) (GitHub Issue, Red Hat CVE).

The root cause is classified as CWE-404 (Improper Resource Shutdown or Release). The /graphql endpoint in birkir/prime accepts an array of GraphQL queries in a single HTTP POST request — a feature known as query batching — without imposing any limit on the number of queries per batch. An unauthenticated remote attacker can exploit this by sending a single HTTP request containing a large array of GraphQL queries, causing the server to process all of them simultaneously and exhausting server resources. A public proof-of-concept was included in the original issue report, demonstrating the attack with a curl command sending an array of 10 repeated queries (GitHub Issue, VulDB).

Successful exploitation results in a denial-of-service condition, degrading or completely disrupting the availability of the affected prime CMS instance. Because no authentication or user interaction is required and the attack is conducted entirely over the network, any internet-exposed prime deployment is at risk. The impact is primarily on availability; confidentiality and integrity are not directly affected by this vulnerability (GitHub Issue, Red Hat CVE).

A public proof-of-concept exploit is available in the original GitHub issue report, demonstrating the attack with a simple curl command requiring no credentials (GitHub Issue). There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.039% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVSS v4.0 exploit maturity is rated as Proof-of-Concept (Feedly).

1. Reconnaissance: Identify internet-facing instances of birkir/prime (version ≤ 0.4.0) by searching for exposed /graphql endpoints using tools like Shodan or Censys, or by fingerprinting the CMS via its GraphQL introspection response.
2. Craft batch query payload: Construct a JSON array containing a large number of repeated GraphQL queries (e.g., hundreds or thousands of { __typename } queries) to maximize server-side processing load.
3. Send the malicious request: Submit the payload as an HTTP POST request to the /graphql endpoint with Content-Type: application/json:

curl -X POST -H "Content-Type: application/json" \
  -d '[{"query": "query cop { __typename }"}, {"query": "query cop { __typename }"}, ...]' \
  'http://<target>/graphql'

4. Repeat or amplify: Send multiple such requests in rapid succession (e.g., via a script or tool like ab or wrk) to overwhelm the server's processing capacity and trigger a denial-of-service condition.
5. Observe impact: The server becomes unresponsive or significantly degraded, denying service to legitimate users (GitHub Issue).

• Network: Unusually high volume of HTTP POST requests to the /graphql endpoint from a single or small set of source IPs; requests with abnormally large Content-Length headers (hundreds of KB or more) targeting /graphql.
• Logs: Web server or application logs showing repeated POST requests to /graphql with JSON array payloads; sudden spike in request rate to the GraphQL endpoint; increased response times or timeout errors in application logs.
• Process/System: Elevated CPU or memory usage on the prime CMS server process correlating with incoming GraphQL batch requests; server process crashes or restarts due to resource exhaustion (GitHub Issue).

No official patch has been released by the project maintainer, who has not responded to the issue report as of the time of disclosure. Users should upgrade to a version of birkir/prime beyond 0.4.0 if and when a patched release becomes available. As an immediate workaround, restrict access to the /graphql endpoint using a web application firewall (WAF) or reverse proxy that limits request body size and rate-limits POST requests per client IP. Additionally, consider disabling GraphQL query batching at the network or middleware level if the feature is not required (GitHub Issue, Red Hat CVE).

A security advisory was published by zast.ai covering this and other unpatched vulnerabilities in the Prime CMS GraphQL implementation, providing additional technical context (zast.ai Advisory). Red Hat has acknowledged the CVE in their security tracking system. The project maintainer has not publicly responded to the issue report as of the disclosure date, which has been noted as a concern in the vulnerability disclosure (GitHub Issue).