CVE-2026-119286
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In GraphQL-core from 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validation context, and error set for the process lifetime.
Risk Assessment
An unauthenticated client can repeatedly submit a small document with more than 100 validation errors, causing unbounded memory growth and eventually exhausting worker memory.
Recommendation
Upgrade GraphQL-core to version 3.3.1 or later. Until patched, consider limiting validation error counts or monitoring memory usage.
Other vulnerabilities in GraphQL-core
See all- CVE-2026-75508High
In GraphQL-core from 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a comment-padded GraphQL document to pass a low token limit while consuming memory.
- CVE-2026-75507High
GraphQL-core versions from 3.0.0 until 3.2.12 and 3.3.0rc1 contain a resource exhaustion vulnerability during query validation. The OverlappingFieldsCanBeMerged rule repeatedly compares fields sharing response names and recursively re-compares flattened inline fragments, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and saturates a multi-worker service.
Original NVD description (English source)
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validation context, and error set for the process lifetime. An unauthenticated client can repeatedly submit a small document with more than 100 validation errors to cause unbounded memory growth before query execution, eventually exhausting worker memory without disclosing or modifying data. This issue is fixed in version 3.3.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS