Vulnerability RUSTSEC-2026-0419

The make_graphql_filter() and make_graphql_filter_sync() filters of juniper_warp read the whole body of a POST request into memory before they parsed the body. The filters had no limit on the size of the body. A client could thus send a large body and exhaust the memory of the server. The request needs no authentication.

juniper_warp 0.9.1 reads at most 2 MiB of a request body by default. The filters respond with 413 Payload Too Large to larger bodies. make_graphql_filter_with_body_limit() and make_graphql_filter_sync_with_body_limit() set another limit.