RUSTSEC-2022-0037: 
Rust vulnerability analysis and mitigation

The vulnerability RUSTSEC-2022-0037 affects the async-graphql library, where a potential denial of service could occur due to unbounded recursion in GraphQL queries. The issue was discovered and addressed in 2022, impacting applications using the async-graphql crate (GitHub Commit).

The vulnerability stems from the lack of recursive depth limitation in GraphQL query processing. Prior to the fix, the library did not implement any restrictions on query depth, which could lead to stack overflow conditions. The fix implemented a default maximum recursive depth of 256 levels for GraphQL queries, with the ability to configure this limit through the limit_recursive_depth function (GitHub Commit).

If exploited, this vulnerability could allow attackers to craft deeply nested GraphQL queries that could potentially cause stack overflow conditions, leading to denial of service of the affected application (GitHub Commit).

The issue has been fixed by implementing a default recursive depth limit of 256 levels. Applications using async-graphql should upgrade to the patched version. Additionally, developers can customize the recursive depth limit using the limit_recursive_depth function to set an appropriate value for their specific use case (GitHub Commit).