PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35441 directus CVE debrief

CVE-2026-35441 is a denial of service vulnerability in Directus GraphQL API. An authenticated user could exploit GraphQL aliasing to repeat an expensive relational query many times in a single request, forcing the server to execute a large number of independent complex database queries concurrently. This could lead to significant resource exhaustion, potentially degrading or crashing the service. The vulnerability exists in Directus versions prior to 11.17.0 and can be mitigated by upgrading to the latest version.

Vendor
directus
Product
Unknown
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-06
Original CVE updated
2026-07-24
Advisory published
2026-04-06
Advisory updated
2026-07-24

Who should care

Users of Directus versions prior to 11.17.0 who have GraphQL endpoints exposed to authenticated users should assess and mitigate this vulnerability. This includes reviewing and limiting GraphQL query complexity and depth, implementing rate limiting on GraphQL queries, and monitoring for unusual query patterns and resource usage.

Technical summary

Directus' GraphQL endpoints (/graphql and /graphql/system) did not deduplicate resolver invocations within a single request prior to version 11.17.0. An authenticated user could exploit GraphQL aliasing to repeat an expensive relational query many times in a single request, forcing the server to execute a large number of independent complex database queries concurrently, multiplying database load linearly with the number of aliases. The existing token limit on GraphQL queries still permitted enough aliases for significant resource exhaustion, while the relational depth limit applied per alias without reducing the total number executed. Rate limiting is disabled by default, meaning no built-in throttle prevented this from causing CPU, memory, and I/O exhaustion that could degrade or crash the service.

Defensive priority

Medium

Recommended defensive actions

  • Upgrade to Directus version 11.17.0 or later
  • Review and limit GraphQL query complexity and depth
  • Implement rate limiting on GraphQL queries
  • Monitor for unusual query patterns and resource usage
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-06T22:16:22.697Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. This information is based on the provided source corpus and may not reflect the full scope of the vulnerability. Users should verify the details with the official CVE record and NVD entry for the most accurate and up-to-date information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35441 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35441

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35441 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35441

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.