p PatchFirst

PatchFirst · Latest vulnerabilities

graphql-core vulnerabilities

Vulnerabilities published for graphql-core in the last 30 days: 2. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2026-75507

    High · CVSS 7.5EPSS 0.56%Public exploitFix available

    GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

    GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can

    graphql-core graphql-corePython
    • Update to 3.2.12
    • Update to 3.3.0rc1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-75508

    High · CVSS 7.5EPSS 0.57%Fix available

    GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

    GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1.

    graphql-core graphql-corePython
    • Update to 3.2.12
    • Update to 3.3.0rc1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →