CVE-2026-75507 · GHSA-vj8h-fx38-h3vc
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
- Risk score
- 69/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- GraphQL-core has a denial of service vulnerability due to quadratic complexity in the OverlappingFieldsCanBeMerged validation rule. An attacker can submit a shallow, highly compressible GraphQL query to pin a worker process and saturate a multi-worker service.
- Affected
- {'products': ['GraphQL-core'], 'packages': [{'ecosystem': 'pip', 'name': 'graphql-core', 'vulnerable': '>= 3.0.0, < 3.2.12'}, {'ecosystem': 'pip', 'name': 'graphql-core', 'vulnerable': '>= 3.3.0a1, < 3.3.0rc1'}], 'versions': ['3.0.0', '3.1.0', '3.2.0', '3.2.11', '3.2.12', '3.3.0a1', '3.3.0rc1']}
- Fix
- Upgrade to version 3.2.12 or 3.3.0rc1
- Exploitation
- Public proof of concept
Not confirmed. 3.1.0, 3.2.0, 3.2.11 isn't in the advisory. Check the vendor's advisory before acting on this.
Why it is Amber
- CVSS 7.5 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| graphql-core | pip | >= 3.0.0, < 3.2.12 | 3.2.12 |
| graphql-core | pip | >= 3.3.0a1, < 3.3.0rc1 | 3.3.0rc1 |
References
- https://github.com/advisories/GHSA-vj8h-fx38-h3vc
- https://github.com/graphql-python/graphql-core/security/advisories/GHSA-vj8h-fx38-h3vc
- https://github.com/graphql-python/graphql-core/commit/150e59814d97d12140be005a558c93188ef89198
- https://github.com/graphql-python/graphql-core/commit/29c2753a7ee30a96a4109e7c6add1a2dae0497d7
- https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12
- https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1
- https://github.com/advisories/GHSA-vj8h-fx38-h3vc
Original description
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
Last activity 22 Oct 2026. Patch Forecast updates every hour.