CVE-2026-75507
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
GraphQL-core versions from 3.0.0 until 3.2.12 and 3.3.0rc1 contain a resource exhaustion vulnerability during query validation. The OverlappingFieldsCanBeMerged rule repeatedly compares fields sharing response names and recursively re-compares flattened inline fragments, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and saturates a multi-worker service.
Risk Assessment
An unauthenticated attacker can block a worker process with a single query and cause denial of service in any application exposing GraphQL. This can disrupt API availability for all users.
Recommendation
Upgrade GraphQL-core to version 3.2.12 or 3.3.0rc1. Until then, consider enforcing query depth and complexity limits at the API gateway and applying timeouts and worker limits.
Other vulnerabilities in GraphQL-core
See all- CVE-2026-119286High
In GraphQL-core from 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validation context, and error set for the process lifetime.
- CVE-2026-75508High
In GraphQL-core from 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a comment-padded GraphQL document to pass a low token limit while consuming memory.
Original NVD description (English source)
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS