Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    6 vulnerabilities by graphql-python

    CVE-2026-119286 (GCVE-0-2026-119286)

    Vulnerability from nvd – Published: 2026-10-29 21:38 – Updated: 2026-10-30 15:58
    VLAI
    Title
    GraphQL-core: Denial of service via memory leak in aborted validations
    Summary
    GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validation context, and error set for the process lifetime. An unauthenticated client can repeatedly submit a small document with more than 100 validation errors to cause unbounded memory growth before query execution, eventually exhausting worker memory without disclosing or modifying data. This issue is fixed in version 3.3.1.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-30 15:47 UTC
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    • CWE-401 - Missing Release of Memory after Effective Lifetime
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 8083 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    graphql-python graphql-core Affected: >= 3.3.0a3, < 3.3.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119286",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T15:47:35.331193Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T15:58:44.342Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "graphql-core",
          "vendor": "graphql-python",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.3.0a3, \u003c 3.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception\u0027s traceback on every raise, retaining each document, validation context, and error set for the process lifetime. An unauthenticated client can repeatedly submit a small document with more than 100 validation errors to cause unbounded memory growth before query execution, eventually exhausting worker memory without disclosing or modifying data. This issue is fixed in version 3.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401: Missing Release of Memory after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T21:38:43.633Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-mpqx-q82w-9x46",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-mpqx-q82w-9x46"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/issues/287",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/issues/287"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/pull/288",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/pull/288"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/commit/3c319fd9f4b8f6c9db4189520561bf8dd0e70be9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/commit/3c319fd9f4b8f6c9db4189520561bf8dd0e70be9"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/releases/tag/v3.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/releases/tag/v3.3.1"
        }
      ],
      "source": {
        "advisory": "GHSA-mpqx-q82w-9x46",
        "discovery": "UNKNOWN"
      },
      "title": "GraphQL-core: Denial of service via memory leak in aborted validations"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119286",
    "datePublished": "2026-10-29T21:38:43.633Z",
    "dateReserved": "2026-10-29T18:50:28.065Z",
    "dateUpdated": "2026-10-30T15:58:44.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-75508 (GCVE-0-2026-75508)

    Vulnerability from nvd – Published: 2026-10-22 16:10 – Updated: 2026-10-29 11:47
    VLAI
    Title
    GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
    Summary
    GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-29 11:46 UTC
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    • CWE-770 - Allocation of Resources Without Limits or Throttling
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 8083 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    graphql-python graphql-core Affected: >= 3.2.3, < 3.2.12
    Affected: >= 3.3.0a3, < 3.3.0rc1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75508",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T11:46:36.041252Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T11:47:15.190Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-r77w-qph3-7vf8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "graphql-core",
          "vendor": "graphql-python",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.2.3, \u003c 3.2.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.3.0a3, \u003c 3.3.0rc1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser\u0027s max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T16:10:17.124Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-r77w-qph3-7vf8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-r77w-qph3-7vf8"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/commit/437dea102e92fdf05a2971ca76787c5a5bad875a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/commit/437dea102e92fdf05a2971ca76787c5a5bad875a"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/commit/80ef435a1808fbbcc4aaac63ae76771a1c91002d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/commit/80ef435a1808fbbcc4aaac63ae76771a1c91002d"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1"
        }
      ],
      "source": {
        "advisory": "GHSA-r77w-qph3-7vf8",
        "discovery": "UNKNOWN"
      },
      "title": "GraphQL-core: Denial of service via comment tokens bypassing the parser\u0027s max_tokens limit"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-75508",
    "datePublished": "2026-10-22T16:10:17.124Z",
    "dateReserved": "2026-08-17T20:49:21.598Z",
    "dateUpdated": "2026-10-29T11:47:15.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-75507 (GCVE-0-2026-75507)

    Vulnerability from nvd – Published: 2026-10-22 16:12 – Updated: 2026-10-23 21:08
    VLAI
    Title
    GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
    Summary
    GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-23 17:32 UTC
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    • CWE-407 - Inefficient Algorithmic Complexity
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 8083 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    graphql-python graphql-core Affected: >= 3.0.0, < 3.2.12
    Affected: >= 3.3.0a1, < 3.3.0rc1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75507",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T17:32:54.760212Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-23T21:08:40.217Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "graphql-core",
          "vendor": "graphql-python",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.2.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.3.0a1, \u003c 3.3.0rc1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n\u00b2\u00b7m\u00b2) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and 3.3.0rc1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T16:12:38.424Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-vj8h-fx38-h3vc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-vj8h-fx38-h3vc"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/commit/150e59814d97d12140be005a558c93188ef89198",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/commit/150e59814d97d12140be005a558c93188ef89198"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/commit/29c2753a7ee30a96a4109e7c6add1a2dae0497d7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/commit/29c2753a7ee30a96a4109e7c6add1a2dae0497d7"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1"
        }
      ],
      "source": {
        "advisory": "GHSA-vj8h-fx38-h3vc",
        "discovery": "UNKNOWN"
      },
      "title": "GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-75507",
    "datePublished": "2026-10-22T16:12:38.424Z",
    "dateReserved": "2026-08-17T20:49:21.598Z",
    "dateUpdated": "2026-10-23T21:08:40.217Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-119286 (GCVE-0-2026-119286)

    Vulnerability from cvelistv5 – Published: 2026-10-29 21:38 – Updated: 2026-10-30 15:58
    VLAI
    Title
    GraphQL-core: Denial of service via memory leak in aborted validations
    Summary
    GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validation context, and error set for the process lifetime. An unauthenticated client can repeatedly submit a small document with more than 100 validation errors to cause unbounded memory growth before query execution, eventually exhausting worker memory without disclosing or modifying data. This issue is fixed in version 3.3.1.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-30 15:47 UTC
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    • CWE-401 - Missing Release of Memory after Effective Lifetime
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 8083 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    graphql-python graphql-core Affected: >= 3.3.0a3, < 3.3.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119286",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T15:47:35.331193Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T15:58:44.342Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "graphql-core",
          "vendor": "graphql-python",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.3.0a3, \u003c 3.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception\u0027s traceback on every raise, retaining each document, validation context, and error set for the process lifetime. An unauthenticated client can repeatedly submit a small document with more than 100 validation errors to cause unbounded memory growth before query execution, eventually exhausting worker memory without disclosing or modifying data. This issue is fixed in version 3.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401: Missing Release of Memory after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T21:38:43.633Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-mpqx-q82w-9x46",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-mpqx-q82w-9x46"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/issues/287",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/issues/287"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/pull/288",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/pull/288"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/commit/3c319fd9f4b8f6c9db4189520561bf8dd0e70be9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/commit/3c319fd9f4b8f6c9db4189520561bf8dd0e70be9"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/releases/tag/v3.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/releases/tag/v3.3.1"
        }
      ],
      "source": {
        "advisory": "GHSA-mpqx-q82w-9x46",
        "discovery": "UNKNOWN"
      },
      "title": "GraphQL-core: Denial of service via memory leak in aborted validations"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119286",
    "datePublished": "2026-10-29T21:38:43.633Z",
    "dateReserved": "2026-10-29T18:50:28.065Z",
    "dateUpdated": "2026-10-30T15:58:44.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-75507 (GCVE-0-2026-75507)

    Vulnerability from cvelistv5 – Published: 2026-10-22 16:12 – Updated: 2026-10-23 21:08
    VLAI
    Title
    GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
    Summary
    GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-23 17:32 UTC
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    • CWE-407 - Inefficient Algorithmic Complexity
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 8083 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    graphql-python graphql-core Affected: >= 3.0.0, < 3.2.12
    Affected: >= 3.3.0a1, < 3.3.0rc1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75507",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T17:32:54.760212Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-23T21:08:40.217Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "graphql-core",
          "vendor": "graphql-python",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.2.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.3.0a1, \u003c 3.3.0rc1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n\u00b2\u00b7m\u00b2) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and 3.3.0rc1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T16:12:38.424Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-vj8h-fx38-h3vc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-vj8h-fx38-h3vc"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/commit/150e59814d97d12140be005a558c93188ef89198",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/commit/150e59814d97d12140be005a558c93188ef89198"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/commit/29c2753a7ee30a96a4109e7c6add1a2dae0497d7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/commit/29c2753a7ee30a96a4109e7c6add1a2dae0497d7"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1"
        }
      ],
      "source": {
        "advisory": "GHSA-vj8h-fx38-h3vc",
        "discovery": "UNKNOWN"
      },
      "title": "GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-75507",
    "datePublished": "2026-10-22T16:12:38.424Z",
    "dateReserved": "2026-08-17T20:49:21.598Z",
    "dateUpdated": "2026-10-23T21:08:40.217Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-75508 (GCVE-0-2026-75508)

    Vulnerability from cvelistv5 – Published: 2026-10-22 16:10 – Updated: 2026-10-29 11:47
    VLAI
    Title
    GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
    Summary
    GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-29 11:46 UTC
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    • CWE-770 - Allocation of Resources Without Limits or Throttling
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 8083 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    graphql-python graphql-core Affected: >= 3.2.3, < 3.2.12
    Affected: >= 3.3.0a3, < 3.3.0rc1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75508",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T11:46:36.041252Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T11:47:15.190Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-r77w-qph3-7vf8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "graphql-core",
          "vendor": "graphql-python",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.2.3, \u003c 3.2.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.3.0a3, \u003c 3.3.0rc1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser\u0027s max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T16:10:17.124Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-r77w-qph3-7vf8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-r77w-qph3-7vf8"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/commit/437dea102e92fdf05a2971ca76787c5a5bad875a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/commit/437dea102e92fdf05a2971ca76787c5a5bad875a"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/commit/80ef435a1808fbbcc4aaac63ae76771a1c91002d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/commit/80ef435a1808fbbcc4aaac63ae76771a1c91002d"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12"
        },
        {
          "name": "https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1"
        }
      ],
      "source": {
        "advisory": "GHSA-r77w-qph3-7vf8",
        "discovery": "UNKNOWN"
      },
      "title": "GraphQL-core: Denial of service via comment tokens bypassing the parser\u0027s max_tokens limit"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-75508",
    "datePublished": "2026-10-22T16:10:17.124Z",
    "dateReserved": "2026-08-17T20:49:21.598Z",
    "dateUpdated": "2026-10-29T11:47:15.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}