CVE-2026-80051

Name of the Vulnerable Software and Affected Versions github.com/graphql-go/graphql versions prior to 0.8.2

Description The software fails to validate that a scalar variable value matches its declared type. Specifically, the coerceString() and coerceBool() functions in scalars.go accept input that does not match the declared String, ID, or Boolean scalar, which contradicts the GraphQL specification requirement to raise a request error. In certain scenarios involving deeply nested values, this can result in an unrecoverable stack overflow, leading to a denial of service.

Recommendations Update github.com/graphql-go/graphql to version 0.8.2 or later.