CVE-2026-33756 Details

A denial-of-service vulnerability has been identified in Saleor, an e-commerce platform, affecting versions 2.0.0 prior to 3.23.0a3, as well as 3.22.47, 3.21.54, and 3.20.118. The issue arises from the platform's support for query batching, which allows multiple GraphQL operations to be submitted in a single HTTP request as a JSON array. However, Saleor did not enforce a limit on the number of operations, enabling an unauthenticated attacker to send requests with excessive operations. This bypassed the per-query complexity limit and exhausted server resources, including CPU, memory, and database connections, while blocking asynchronous workers.

Users are advised to upgrade to Saleor versions 3.23.0a3, 3.22.47, 3.21.54, or 3.20.118. If an immediate upgrade is not possible, it is recommended to implement a live patch at the Web Application Firewall (WAF) level by limiting the size of the request body, restricting the number of items in JSON arrays, or blocking arrays in JSON bodies altogether.