CVE-2026-35401

BRIEFING NOTE: CVE-2026-35401 Saleor e-commerce platform versions 2.0.0 through 3.22.46, 3.20.117, and 3.21.53 contain a resource exhaustion vulnerability that allows unauthenticated attackers to abuse the GraphQL API. By submitting a single API call containing numerous mutations or queries through aliases or mutation chaining, threat actors can trigger excessive resource consumption on the affected server. This vulnerability has been patched in versions 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118. The vulnerability carries a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The attack has low complexity and results in high availability impact through denial of service. However, no confidentiality or integrity compromise occurs, limiting the scope to availability disruption. Current exploitation status indicates this vulnerability is not actively being exploited in the wild, as evidenced by its absence from CISA's Known Exploited Vulnerabilities catalog and its inactive status on threat intelligence hot lists. The EPSS score of 0.00055 suggests minimal real-world exploitation likelihood. Community attention remains moderate, warranting prompt patching for internet-facing Saleor deployments to prevent potential denial-of-service attacks.