CVE-2026-75508 · GHSA-r77w-qph3-7vf8
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
- Risk score
- 69/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A denial of service vulnerability exists in GraphQL-core due to a comment tokens bypassing the parser's max_tokens limit, allowing an attacker to exhaust worker memory. An unauthenticated remote attacker can exploit this vulnerability.
- Affected
- {'products': ['GraphQL-core'], 'packages': [{'ecosystem': 'pip', 'name': 'graphql-core', 'vulnerable': '>= 3.2.3, < 3.2.12'}, {'ecosystem': 'pip', 'name': 'graphql-core', 'vulnerable': '>= 3.3.0a3, < 3.3.0rc1'}], 'versions': ['3.2.3', '3.2.12', '3.3.0rc1']}
- Fix
- Upgrade to version 3.2.12 or 3.3.0rc1
- Exploitation
- Public proof of concept
Story map
At a glance
graphql-core: Amber, patch this week. A denial of service vulnerability exists in GraphQL-core due to a comment tokens bypassing the parser's max_tokens limit, allowing an attacker to exhaust worker memory. An unauthenticated remote attacker can exploit this vulnerability.
The flaws
- CVE-2026-75508: GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit (CVSS 7.5 · EPSS 1%)
- CVE-2026-75507: GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule (CVSS 7.5 · EPSS 1%)
The fix
Upgrade graphql-core: 3.2.12 · 3.3.0 or later on your release line
Who is exposed: {'products': ['GraphQL-core'], 'packages': [{'ecosystem': 'pip', 'name': 'graphql-core', 'vulnerable': '>= 3.2.3, < 3.2.12'}, {'ecosystem': 'pip', 'name': 'graphql-core', 'vulnerable': '>= 3.3.0a3, < 3.3.0rc1'}], 'versions': ['3.2.3', '3.2.12', '3.3.0rc1']}
Where it stands
- Public proof of concept
Connects to
- Same weakness: Denial of service (CWE-400). 252 other warnings in 30 days
Why it is Amber
- CVSS 7.5 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| graphql-core | pip | >= 3.2.3, < 3.2.12 | 3.2.12 |
| graphql-core | pip | >= 3.3.0a3, < 3.3.0rc1 | 3.3.0rc1 |
References
- https://github.com/advisories/GHSA-r77w-qph3-7vf8
- https://github.com/graphql-python/graphql-core/security/advisories/GHSA-r77w-qph3-7vf8
- https://github.com/graphql-python/graphql-core/commit/437dea102e92fdf05a2971ca76787c5a5bad875a
- https://github.com/graphql-python/graphql-core/commit/80ef435a1808fbbcc4aaac63ae76771a1c91002d
- https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12
- https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1
- https://github.com/advisories/GHSA-r77w-qph3-7vf8
Original description
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
Last activity 22 Oct 2026. Patch Forecast updates every hour.