Critical severity · published Jan 19, 2026
CVE-2026-1173
birkir prime GraphQL Array Based Query Batch graphql denial of service
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
A vulnerability was found in birkir prime up to 0.4.0.beta.0. The impacted element is an unknown function of the file /graphql of the component GraphQL Array Based Query Batch Handler. The manipulation results in denial of service. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
prime · birkir
0.4.0.beta · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1173
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1173
github.com
https://github.com/birkir/prime/
Exploit
https://github.com/birkir/prime/issues/544
Permissions Required
https://vuldb.com/?ctiid.341767
Third Party Advisory
https://vuldb.com/?id.341767
Third Party Advisory
https://vuldb.com/?submit.731104
More from prime
8.8
CVE-2026-1169
birkir prime cross-site request forgery
7.5
CVE-2026-1175
birkir prime GraphQL Directive graphql information exposure
7.5
CVE-2026-1174
birkir prime GraphQL Alias graphql resource consumption
7.5
CVE-2026-1172
birkir prime GraphQL Directive graphql denial of service
7.5
CVE-2026-1171
birkir prime GraphQL Field graphql denial of service
