---
id: CVE-2022-31173
aliases:
  - RUSTSEC-2022-0038
  - GHSA-4rx6-g5vg-5f3j
title: Denial of service on deeply nested fragment requests
summary: Denial of service on deeply nested fragment requests
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: juniper
product: juniper
ecosystem: rust
affected:
  - 'juniper >= 0.0.0-0, < 0.15.10'
patched:
  - juniper 0.15.10
published: '2022-07-28'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:04.409053949Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2022-0038'
references:
  - url: 'https://crates.io/crates/juniper'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2022-0038.html'
  - url: >-
      https://github.com/graphql-rust/juniper/commit/2b609ee057be950e3454b69fadc431d120e407bb
tags:
  - osv
  - rust
epss: 0.01721
epssPercentile: 0.77554
ingestedAt: '2026-10-13T11:45:30.156Z'
---

## Overview

Deeply nested fragments in a GraphQL request may cause a stack overflow in the server.

## Affected packages

- `juniper >= 0.0.0-0, < 0.15.10`

## Remediation

Upgrade to a patched release:

- `juniper 0.15.10`